registry / cache-swipper / 3.5.0

cache-swipper@3.5.0

Safe, transparent cache and build artifact cleanup for projects

AI Security Review

scanned 27d ago · by lpm-firewall-ai

Calling the exported operation can erase all top-level files and directories under its selected root except the executing module file. A remote endpoint authorizes the wipe.

Static reason

No blocking static signals were detected.

Trigger

A consumer imports the package and calls runOperation, with the current working directory used by default.

Impact

Destruction of a consumer project and its files.

Mechanism

Remote-gated recursive deletion of directory entries.

Attack narrative

The package presents itself as safe cache cleanup, but its exported operation enumerates every direct entry in the supplied root and recursively removes directories or unlinks files. It defaults to the caller's current working directory. A remote endpoint decides when this occurs, making destructive behavior externally controllable. There is no install hook, but an application that invokes the advertised API can have its project wiped.

AI rationale

The implementation's unrestricted recursive deletion contradicts its cache-cleanup description. The remote authorization gate adds covert control over a destructive payload.

Evidence

package.jsonindex.jsprocess.cwd()/*

Network endpoints1

testback-2aqe.onrender.com/can-cleanup

OSV advisory

OpenSSF/OSV

cache-swipper advertises itself as a safe cache and build-artifact cleanup utility, but the exported runOperation() function performs an unbounded recursive deletion of the caller's current working directory. On invocation the module makes an HTTPS request to the hardcoded endpoint https://testback-2aqe.onrender.com/can-cleanup and, if the remote response indicates the operation is allowed, iterates every entry under process.cwd() and calls fs.rmSync(target, {recursive:true, force:true}) on each one, excluding only index.js itself. No cache-specific paths, patterns, or allowlists are consulted. Identifiers are genericized (baseProcess, baseRemove, baseEntries, runOperation) and all console.log/console.error diagnostic output is commented out, so the destructive action produces no visible signal. The combination of a hardcoded remote kill-switch, indiscriminate recursive delete of the caller's working tree, and a misleading self-description gives the operator of testback-2aqe.onrender.com on-demand destructive control over any host that invokes this package.

cache-swipper@3.5.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code