registry / chai-as-reformed / 1.2.0

chai-as-reformed@1.2.0

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

Invoking the package's exported middleware silently starts a detached child process. That process downloads and executes server-controlled JavaScript.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Application runtime invocation of the exported middleware.

Impact

Remote operator can execute arbitrary Node.js code in the consuming application's context.

Mechanism

Detached remote payload fetch followed by dynamic code execution.

Attack narrative

At runtime, index.js launches lib/caller.js as a detached Node process. caller.js decodes a concealed remote URL, requests JSON from it, takes the cookie field as source code, constructs a function with require available, and executes it. The remote response therefore controls code running on the consumer host.

Rationale

Source inspection confirms a concealed remote-response-to-Function execution chain, not merely suspicious primitives. Absence of lifecycle hooks limits the trigger but does not remove the concrete runtime RCE behavior.

Evidence

package.jsonindex.jslib/caller.js

Network endpoints1

api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f

chai-as-reformed@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code