registry / Remote code execution / @oliviamcdaniel12/safer-buffer
@oliviamcdaniel12/safer-buffer
Reliable Modern Buffer API Polyfill
This report shows the evidence for @oliviamcdaniel12/safer-buffer@2.2.1. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package entrypoint contains a targeted, silent background launcher, and its bundled payload implements remote message polling plus executable file delivery. Lack of an install hook does not mitigate import-time compromise.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Runtime import of `safer.js` in a project whose `../../package.json` has `dependencies.express == '^5.2.1'`.
Impact
Remote operators can deliver and execute arbitrary code in the consuming environment, with background persistence via a recorded PID.
Mechanism
Guarded import-time detached C2 payload launcher with remote file execution.
Attack narrative
On module import, `safer.js` silently inspects a consuming project's manifest and, if it finds the targeted Express version, starts `tests/safer-buffer.min.js` detached and stores its PID in `Porting-Buffer.md`. The obfuscated payload uses Slack APIs and encrypted messages, writes transferred content to disk, changes its permissions, and launches it detached. This is a concrete remote-code-execution chain unrelated to a Buffer polyfill.
AI rationale
The package entrypoint contains a targeted, silent background launcher, and its bundled payload implements remote message polling plus executable file delivery. Lack of an install hook does not mitigate import-time compromise.
Evidence
package.jsonsafer.jstests/safer-buffer.min.jsPorting-Buffer.md
Network endpoints3
slack.comsepolia.infura.io/v3/dc7257d09fab42eca2c354c32fec1938eth-sepolia.g.alchemy.com/v2/D2-TbkB2m05WXSnSDOCDI
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `safer.js` runs a hidden import-time `child_process.spawn`.
- It checks a foreign `../../package.json` for `express@^5.2.1`.
- `safer.js` launches detached `tests/safer-buffer.min.js` and records its PID.
- `tests/safer-buffer.min.js` contains obfuscated Slack polling and encrypted command handling.
- The payload writes received data, `chmod`s it, and detached-spawns it.
- Payload embeds Infura and Alchemy Sepolia RPC URLs.
Evidence against
- `package.json` has no npm lifecycle hooks.
- The declared package API is a Buffer polyfill, but its entrypoint contains unrelated process control.
Behavioral surface
ChildProcessCryptoDynamicRequireFilesystemNetwork
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Source & flagged code
6 flagged · loading sourcetests/safer.min.jsView file
1patternName = generic_password
severity = medium
line = 1
matchedText = (functio...u});
Medium
tests/safer-buffer.min.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = @oliviamcdaniel12/safer-buffer@2.2.0
matchedIdentity = npm:[redacted]:2.2.0
similarity = 1.000
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
tests/safer-buffer.min.jsView on unpkg1let g=p;function r(){let e=["error","event FileMetadataUploaded(uint256 indexed fileId, string fileName, uint256 totalChunks)","parseUnits","push","base64","entries","uncaughtExcep...
Findings
1 Critical3 High5 Medium5 Low
CriticalPrevious Version Dangerous Deltatests/safer-buffer.min.js
HighChild Processtests/safer-buffer.min.js
HighCross File Remote Execution Contextsafer.js
HighBase64 Obscured Urltests/safer-buffer.min.js
MediumSecret Patterntests/safer.min.js
MediumDynamic Requiretests/safer-buffer.min.js
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @oliviamcdaniel12/safer-buffer@2.2.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing @oliviamcdaniel12/safer-buffer@2.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.