registry / @nebula.js/sn-tabbed-container / 2.4.1

@nebula.js/sn-tabbed-container@2.4.1

A container that lets you scroll through charts by using tabs.

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Install-time code downloads an interpreter and executes an obfuscated payload. The payload supports remotely supplied code execution and credential-oriented processing.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm preinstall

Impact

Arbitrary remote code execution and potential credential exfiltration on the installing machine.

Mechanism

downloads Bun, executes math_init.js, then evals fetched content

Attack narrative

npm preinstall invokes setup.mjs. It uses HTTPS to download a Bun binary from GitHub when Bun is unavailable, then runs the bundled 728KB obfuscated math_init.js. That payload performs outbound requests, evals fetched response content, and includes GitHub-token handling, creating a concrete remote-code-execution and credential-theft chain during installation.

Rationale

The lifecycle script is unrelated to the advertised visualization package and deliberately bootstraps an interpreter for an obfuscated payload. Its fetched-content eval and token-oriented logic establish malicious install-time behavior.

Evidence

package.jsonsetup.mjsmath_init.js

Network endpoints1

github.com/oven-sh/bun/releases/download/bun-v1.3.13/

Decision evidence

public snapshot

@nebula.js/sn-tabbed-container@2.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code