registry / date-fns-sync / 1.0.0

date-fns-sync@1.0.0

A high-performance, thread-safe in-memory cache module for Node.js applications using **Worker Threads** to provide efficient multi-threaded cache operations.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package runs code that retrieves and executes an attacker-controlled remote payload. The payload is not present locally and can change after publication.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install executes the postinstall lifecycle hook.

Impact

Arbitrary code execution in the installing user's environment.

Mechanism

Fetch remote JSON and evaluate its token field as JavaScript.

Attack narrative

On installation, npm runs index.js through postinstall. That file reconstructs a remote URL from character codes, fetches JSON from it, extracts token, and passes it to eval. This gives the remote endpoint arbitrary code execution on every install and hides the payload from the package archive.

Rationale

This is a concrete install-time remote-code-execution chain, not a package feature. The mismatched README further supports deceptive intent.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

kongregate-api-config.vercel.app/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

date-fns-sync@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code