registry / Remote code execution / async-mutex-v2
async-mutex-v2
A fast, lightweight, Promise-based mutex for JavaScript and TypeScript applications.
This report shows the evidence for async-mutex-v2@2.1.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms a remotely controlled arbitrary-code execution path exposed by the package runtime API. The absent lifecycle hook limits install-time behavior but does not mitigate the concrete runtime RCE.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer imports the package and invokes its default export.
Impact
A remote server can run arbitrary code in the consuming application's process, including loading modules and accessing local resources.
Mechanism
Remote payload fetch followed by `new Function` execution with privileged Node globals.
Attack narrative
When a caller invokes the package's default export, `index.js` requests `https://svganchordev.net/icons/108`, parses JSON, and evaluates the server-controlled `credits` field through `new Function`. The payload is given `require`, `process`, global state, and timers, so the endpoint can supply arbitrary Node.js code. The documented mutex API is absent; the actual export is a remote code loader.
AI rationale
Direct source inspection confirms a remotely controlled arbitrary-code execution path exposed by the package runtime API. The absent lifecycle hook limits install-time behavior but does not mitigate the concrete runtime RCE.
Evidence
index.jspackage.jsonREADME.md
Network endpoints1
svganchordev.net/icons/108
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` fetches a remote response from `https://svganchordev.net/icons/108`.
- `index.js` passes remote `data.credits` directly to `new Function(...)`.
- The evaluated payload receives `require`, `process`, `global`, `Buffer`, and filesystem-relative paths.
- The package exports this remote-loader instead of the documented `Mutex` API.
- `package.json` has no lifecycle hook, but runtime invocation enables arbitrary remote code.
Evidence against
- No install, preinstall, or postinstall lifecycle script is declared.
- No direct credential collection or file writes are present in the inspected source before remote payload execution.
Behavioral surface
EvalNetwork
Source & flagged code
2 flagged · loading sourceindex.jsView file
149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = font-hub@1.5.2
matchedPath = index.js
matchedIdentity = npm:Zm9udC1odWI:1.5.2
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgFindings
2 High1 Medium1 Low
HighEvalindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to async-mutex-v2@2.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing async-mutex-v2@2.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.