registry / cors-security / 1.0.1

cors-security@1.0.1

Professional zero-dependency SVG utilities for Node.js.

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The CommonJS entry point contains a concealed remote-code loader. It runs server-provided JavaScript with access to require after the exported helper is invoked.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A CommonJS consumer calls getPlugin() and invokes the returned function.

Impact

Remote operator can execute arbitrary Node.js code in the consumer process.

Mechanism

HTTPS fetch with disabled TLS verification followed by dynamic code execution

Attack narrative

An undocumented CommonJS-only getPlugin helper retrieves data from workconfig.vercel.app with rejectUnauthorized:false and passes it to new Function together with require. The fetched response therefore becomes executable Node.js code in the caller's process. The helper is absent from the ESM API, types, and documentation, concealing this behavior behind an SVG utility package.

Rationale

The concealed remote payload loader is concrete arbitrary code execution, not required for the documented SVG functionality. Absence of install hooks limits automatic activation but does not remove the malicious backdoor.

Evidence

package.jsonsrc/index.cjssrc/index.mjssrc/index.d.tsREADME.mdbin/svgcraft.mjs

Network endpoints1

workconfig.vercel.app

cors-security@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code