registry / Remote code execution / alpha-helper
alpha-helper
A lightweight and flexible utility toolkit for simplifying common development tasks with clean, reusable helper functions.
This report shows the evidence for alpha-helper@1.3.4, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exported API is called.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer invokes the default export getPlugin().
Impact
The endpoint operator can run arbitrary code in the consuming process, including loading modules and accessing process data.
Mechanism
Remote payload fetch followed by Function execution with Node globals.
Attack narrative
A call to the exported getPlugin function requests a JSON object from the hard-coded IP endpoint, takes data.credits, compiles it with new Function, and invokes it with require, process, global, Buffer, and runtime path values. The remote server therefore controls code executed in the consumer's Node process.
AI rationale
The package contains a concrete remote-code loader with broad Node capabilities and misleading helper/icon framing. No lifecycle hook is needed for the malicious behavior once its exported API is called.
Evidence
index.jspackage.jsonREADME.md
Network endpoints1
46.183.25.232:45000/icons/116
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js:106-119 builds a request to https://46.183.25.232:45000/icons/116.
- index.js:127-152 passes response JSON data.credits directly to new Function.
- index.js:156-170 executes that remote code with require, process, global, Buffer, and filesystem paths.
- README.md documents an unrelated package/API, inconsistent with the manifest and payload behavior.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Importing index.js defines the function but does not call it; execution requires invoking the default export.
Behavioral surface
EvalNetwork
Source & flagged code
2 flagged · loading sourceindex.jsView file
149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = poly-custom-api@5.3.1
matchedPath = index.js
matchedIdentity = npm:cG9seS1jdXN0b20tYXBp:5.3.1
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgFindings
2 High1 Medium1 Low
HighEvalindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to alpha-helper@1.3.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing alpha-helper@1.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.