A hidden runtime payload is embedded in an imported Express route. It retrieves staged code from dynamically derived network infrastructure, evaluates it, and starts detached hidden processes.
Static reason
One or more suspicious static signals were detected.
Trigger
Running `server.js` (including the package `dev` script) imports `src/app.js` and then the poisoned route.
Impact
Arbitrary attacker-controlled code execution and persistence-like background process launch.
Mechanism
Obfuscated staged remote-code loader with detached-process execution.
Attack narrative
On application startup, `server.js` imports `src/app.js`, which imports `playground/src/routes/auth.routes.js`. Code appended after the normal router dynamically decodes a second stage, queries JSON-RPC for encoded transaction data, derives a host from it, fetches encrypted payloads over HTTPS, evaluates one, and launches another detached with hidden windows. The endpoint is intentionally computed at runtime rather than present as a literal.
Rationale
The package contains a concrete concealed remote-code execution chain unrelated to its advertised scaffolding function. Absence of an install hook does not mitigate execution when its server entrypoint runs.
Evidence
package.jsonserver.jssrc/app.jsplayground/src/routes/auth.routes.jssrc/utils/fileHelper.js