ecto
Modern Template Consolidation Engine for EJS, Markdown, Pug, Nunjucks, Liquid, and Handlebars
This report shows the evidence for ecto@5.0.1. 1 of 3 known versions is blocked or flagged. The newest version, 5.1.1, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete unconsented install-time staged execution, not a package-aligned build step. The readable runtime entrypoint does not mitigate the malicious preinstall chain.
Static reason
One or more suspicious static signals were detected.
Trigger
npm preinstall during package installation
Impact
Arbitrary code may execute with the installer user's permissions, enabling credential theft or further payloads.
Mechanism
obfuscated downloader and staged payload execution
Attack narrative
The preinstall hook invokes setup.mjs without user action. That obfuscated loader selects/downloads a Bun executable and uses it to run Math_Symbol.js. The large concealed payload includes remote-response evaluation plus filesystem, process, and token-oriented behavior, creating a concrete install-time malware chain unrelated to ecto's template functionality.
AI rationale
This is concrete unconsented install-time staged execution, not a package-aligned build step. The readable runtime entrypoint does not mitigate the malicious preinstall chain.
Evidence
package.jsonsetup.mjsMath_Symbol.jsdist/ecto.mjs
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs `node setup.mjs` as preinstall.
- setup.mjs is obfuscated and downloads a platform-specific Bun binary before executing `Math_Symbol.js`.
- Math_Symbol.js is a 727 KB obfuscated payload, unrelated to the template-engine entrypoint.
- Math_Symbol.js contains remote-response `eval`, child-process use, filesystem access, and token-oriented logic.
Evidence against
- dist/ecto.mjs is a readable template-rendering implementation.
- The malicious lifecycle payload is separate from the declared runtime entrypoint.
Behavioral surface
EvalFilesystem
HighEntropyStringsMinified
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node setup.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgMath_Symbol.jsView file
1// @bun @bun-cjs
L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...
Low
Eval
Package source references a known benign dynamic code generation pattern.
Math_Symbol.jsView on unpkg · L1setup.mjsView file
1Manifest entrypoint (scripts.preinstall) carries capability families absent from dist/build output: execution+network
L1: #!/usr/bin/env node
L2: (function(e,f){const wS={e:'0xb8',f:'@JTg',M:'0x5',J:0x87,F:'^6ZM',N:0x3f,g:0x61,O:'0xc9',P:'LeMK',R:'0x2a',A:'P]$u',q:0xc};function Y(e,f){return i(e- -'0x2b4',f);}const M=e();whi...
Findings
3 High1 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighEntrypoint Build Divergencesetup.mjs
HighObfuscated Payload Loadersetup.mjs
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvalMath_Symbol.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ecto@5.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing ecto@5.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.