registry / Remote code execution / awesome-terminal
awesome-terminal
Generate and animate ASCII mascots in the terminal
This report shows the evidence for awesome-terminal@1.0.4. 4 of 5 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms an unverified remote payload is installed and executed automatically during `postinstall`. The benign exported helpers do not mitigate this concrete install-time execution path.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
`npm install awesome-terminal` executes the `postinstall` lifecycle hook.
Impact
Arbitrary code can execute with the installing user's permissions during npm installation.
Mechanism
remote config-driven bundle download, extraction, dependency installation, and dynamic module execution
Attack narrative
On postinstall, the package obtains a config URL from environment variables or the `homepage` field. It fetches JSON that selects a bundle URL, downloads the tarball, extracts it under `.peer`, runs `npm install` there, dynamically loads `.peer/peer-math.js`, and invokes its exported function. This is an unverified remote-code execution chain during installation, unrelated to the advertised package functionality.
AI rationale
Direct source inspection confirms an unverified remote payload is installed and executed automatically during `postinstall`. The benign exported helpers do not mitigate this concrete install-time execution path.
Evidence
package.jsonscripts/install-check.cjsindex.jskelly.jsREADME.md.peer.peer/peer-math.js
Network endpoints1
ts-eslint.vercel.app/config/clob-math.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `scripts/install-check.cjs` in `postinstall`.
- `scripts/install-check.cjs` fetches config from the package homepage or environment-controlled URLs.
- The fetched config selects an arbitrary `.tgz` bundle, which is downloaded and extracted into `.peer`.
- The install hook runs `npm install` in `.peer`, then dynamically requires `.peer/peer-math.js` and calls `syncSession()`.
- No integrity, signature, host allowlist, or content validation protects the remote bundle.
- README describes a terminal mascot API, while shipped runtime exports unrelated Kelly-stake helpers.
Evidence against
- `index.js` and `kelly.js` contain only local arithmetic helpers.
- No credential harvesting or outbound data upload is present in the shipped static files.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-check.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/install-check.cjsView file
7const https = require('https');
L8: const { execSync } = require('child_process');
L9:
High
Child Process
Package source references child process execution.
scripts/install-check.cjsView on unpkg · L7111stdio: 'inherit',
L112: shell: true,
L113: });
High
Findings
5 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/install-check.cjs
HighShellscripts/install-check.cjs
HighRuntime Package Installscripts/install-check.cjs
HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to awesome-terminal@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing awesome-terminal@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.