registry / Remote code execution / @vboxdev/common
@vboxdev/common
This report shows the evidence for @vboxdev/common@1.0.73. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe import-time, obfuscated, blockchain-addressed payload retrieval and execution chain is concrete malicious behavior. Absence of an install hook does not mitigate runtime RCE on normal package use.
Static reason
One or more suspicious static signals were detected.
Trigger
Any runtime import/require of @vboxdev/common main entrypoint.
Impact
Arbitrary code execution in the consuming application's account; embedded service credentials are also exposed.
Mechanism
Obfuscated blockchain-addressed remote payload loader with eval and detached Node execution.
Attack narrative
When the package main entrypoint is imported, its trailing base64-obfuscated loader runs. It queries Ethereum services, extracts an IPv4 address from a selected transaction, downloads XOR-obfuscated code from that dynamic host, evals it, and launches detached `node -e` instances containing the fetched code. This is a covert remote-code-execution chain unrelated to the package's middleware functionality.
AI rationale
The import-time, obfuscated, blockchain-addressed payload retrieval and execution chain is concrete malicious behavior. Absence of an install hook does not mitigate runtime RCE on normal package use.
Evidence
package.jsonbuild/index.jsbuild/middlewares/push-notification.jsbuild/services/serviceAccountKey.json
Network endpoints5
1rpc.io/etheth.drpc.orgethereum-rpc.publicnode.cometh-mainnet.public.blastapi.ioeth.blockscout.com/api
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- build/index.js appends an obfuscated eval(atob(...)) payload to the main entrypoint.
- The decoded payload runs immediately on module import and queries Ethereum RPC/explorer services.
- It derives a remote IPv4 host from blockchain transaction data, fetches XOR-obfuscated payloads, and evals one.
- It spawns detached `node -e` processes with fetched code, enabling remote code execution.
- build/services/serviceAccountKey.json embeds a Firebase service-account private key.
Evidence against
- package.json contains no npm lifecycle hook.
- Other exports implement ordinary middleware and event helpers.
Behavioral surface
EnvironmentVarsEval
HighEntropyStrings
Source & flagged code
4 flagged · loading sourcebuild/services/serviceAccountKey.jsonView file
5patternName = private_key_rsa
severity = critical
line = 5
matchedText = "private...\n",
Critical
Critical Secret
Package contains a critical-looking secret pattern.
build/services/serviceAccountKey.jsonView on unpkg · L55patternName = private_key_rsa
severity = critical
line = 5
matchedText = "private...\n",
Critical
Secret Pattern
RSA private key in build/services/serviceAccountKey.json
build/services/serviceAccountKey.jsonView on unpkg · L5build/index.jsView file
48__exportStar(require("./events/types/user-status"), exports);
L49: __exportStar(require("./events/expiration-verification-events"), exports); ...
Low
Eval
Findings
2 Critical1 High1 Medium3 Low
CriticalCritical Secretbuild/services/serviceAccountKey.json
CriticalSecret Patternbuild/services/serviceAccountKey.json
HighSame File Env Network Executionbuild/index.js#virtual:base64:round1
MediumEnvironment Vars
LowScripts Present
LowEvalbuild/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @vboxdev/common@1.0.73.
The versions list below shows the verdict for each recorded version.
- Avoid installing @vboxdev/common@1.0.73. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.