registry / Remote code execution / elephant-array-utils
elephant-array-utils
Install:
This report shows the evidence for elephant-array-utils@1.0.6, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis package has concrete import-time payload staging and execution behavior, not array utility functionality. Obfuscation and hidden execution establish a malicious remote-code-execution chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Runtime require/import of elephant-array-utils.
Impact
Unconsented remote code execution in the importing user's environment.
Mechanism
Obfuscated import-time downloader, payload dropper, and child-process launcher.
Attack narrative
The main entrypoint immediately executes an obfuscated IIFE. Its source loads OS/filesystem helpers and hidden modules, processes a remote response, derives a file under the user home directory, writes decoded content, and starts a hidden child process from the home-directory context. Empty error handlers suppress failures. The payload host and dropped filename are string-obfuscated, but the downloader-to-write-to-launch chain is directly present in source.
AI rationale
This package has concrete import-time payload staging and execution behavior, not array utility functionality. Obfuscation and hidden execution establish a malicious remote-code-execution chain.
Evidence
index.jspackage.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js is entirely obfuscated and runs a top-level IIFE on import.
- The IIFE loads os, fs and additional hidden modules, then uses a Promise-based remote-response flow.
- It derives a path from os.homedir(), writes response-derived decoded bytes with a write mode, then invokes a hidden child-process API.
- Execution is concealed with empty catch handlers and windowsHide options.
- package.json exposes index.js as the sole main entrypoint, so requiring the package triggers this behavior.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No plaintext endpoint is recoverable without executing the package decoder.
Behavioral surface
HighEntropyStringsMinifiedTrivial
Source & flagged code
1 flagged · loading sourceindex.jsView file
1function c(b,d){b=b-(-0x44b*0x5+-0x3a*-0x37+0x9dc);var e=a();var f=e[b];if(c['zmwvKT']===undefined){var g=function(l){var m='[redacted]...
High
Obfuscated Payload Loader
Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.
index.jsView on unpkg · L1Findings
1 High1 Medium2 Low
HighObfuscated Payload Loaderindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to elephant-array-utils@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing elephant-array-utils@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.