registry / Remote code execution / anhn-cli
anhn-cli
A personal command line
This report shows the evidence for anhn-cli@1.1.4. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiConfirmed source establishes a reachable obfuscated remote payload loader with eval and detached process execution. Absence of an npm lifecycle hook does not mitigate runtime execution on every CLI invocation.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the anhn CLI (any subcommand) or importing bin/index.js.
Impact
Arbitrary attacker-controlled code execution in the invoking user's environment.
Mechanism
obfuscated remote payload retrieval and execution
Attack narrative
The CLI entrypoint unconditionally requires bin/install/install.js. After its legitimate export, that file contains an obfuscated loader which obtains a runtime-selected payload, evaluates constructed code, and spawns a detached Node process. This is hidden remote code execution during ordinary CLI use, not required by the stated personal-CLI functionality.
AI rationale
Confirmed source establishes a reachable obfuscated remote payload loader with eval and detached process execution. Absence of an npm lifecycle hook does not mitigate runtime execution on every CLI invocation.
Evidence
bin/index.jsbin/install/install.jspackage.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- CLI entrypoint top-level imports the compromised install module on every invocation.
- Appended obfuscated code fetches a hidden payload then evaluates it and launches detached Node code.
- The hidden loader derives its command endpoint at runtime, enabling attacker-controlled remote execution.
Evidence against
- package.json has no npm lifecycle hook; activation is runtime via the CLI entrypoint.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsNetworkShell
MinifiedObfuscatedUrlStrings
Source & flagged code
6 flagged · loading sourcebin/open-site/open-site.jsView file
1const open = require('open')
L2: const inquirer = require('inquirer')
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/open-site/open-site.jsView on unpkg · L1bin/harvest/harvest-cli.jsView file
14L15: fetch('https://api.harvestapp.com//v2/time_entries', {
L16: method: 'POST',
...
L19: 'Content-Type': 'application/json',
L20: Authorization: `Bearer ${process.env.HARVEST_ACCESS_TOKEN}`,
L21: 'Harvest-Account-ID': process.env.HARVEST_ACCOUNT_ID,
L22: },
L23: body: JSON.stringify({
L24: project_id: process.env.HARVEST_PROJECT_ID,
...
L32: })
L33: .then(function(res) { return res.json() })
L34: .then(function(data) { console.log(data) })
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
bin/harvest/harvest-cli.jsView on unpkg · L1414Trigger-reachable chain: manifest.main -> bin/index.js -> bin/harvest/harvest-cli.js
L14:
L15: fetch('https://api.harvestapp.com//v2/time_entries', {
L16: method: 'POST',
...
L19: 'Content-Type': 'application/json',
L20: Authorization: `Bearer ${process.env.HARVEST_ACCESS_TOKEN}`,
L21: 'Harvest-Account-ID': process.env.HARVEST_ACCOUNT_ID,
L22: },
L23: body: JSON.stringify({
L24: project_id: process.env.HARVEST_PROJECT_ID,
...
L32: })
L33: .then(function(res) { return res.json() })
L34: .then(function(data) { console.log(data) })
Findings
2 Critical4 High4 Medium2 Low
CriticalCredential Exfiltrationbin/harvest/harvest-cli.js
CriticalTrigger Reachable Dangerous Capabilitybin/harvest/harvest-cli.js
HighObfuscated Payload Loaderbin/install/install.js
HighTrigger Reachable Credential Exfiltrationbin/harvest/harvest-cli.js
HighObfuscated
HighAi Review Evidencebin/index.js
MediumDynamic Requirebin/open-site/open-site.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to anhn-cli@1.1.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing anhn-cli@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.