registry / Remote code execution / eslint-plugin-vitest-ts
eslint-plugin-vitest-ts
Copyright (c) React Training 2015-present
This report shows the evidence for eslint-plugin-vitest-ts@1.0.4. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe install-time detached loader fetches and executes attacker-controlled remote code, which is concrete malicious behavior unrelated to an ESLint plugin.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall
Impact
Arbitrary code execution on the installing machine; payload behavior is remotely changeable.
Mechanism
detached remote payload loader with dynamic code execution
Attack narrative
During npm postinstall, the package starts a detached Node child process. That process reads a concealed local payload file, then fetches JSON from JSONBin and compiles the response's record.cookie field through new Function, supplying require. This gives a remotely controlled payload arbitrary Node module access on the installer machine and lets the attacker alter behavior after publication.
AI rationale
The install-time detached loader fetches and executes attacker-controlled remote code, which is concrete malicious behavior unrelated to an ESLint plugin.
Evidence
package.jsonlib/utils/index.jslib/utils/smtp-connection/index.jslib/utils/smtp-connection/LICENSElib/utils/smtp-connection/parse.js
Network endpoints1
api.jsonbin.io/v3/b/6a72aa2bda38895dfebb1302
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json postinstall runs lib/utils/index.js.
- lib/utils/index.js spawns and detaches a child Node process.
- lib/utils/smtp-connection/index.js fetches a remote JSONBin URL.
- That script passes remotely supplied record.cookie to new Function with require access.
- lib/utils/smtp-connection/LICENSE is an opaque hex payload with AES decryption helper in parse.js.
Evidence against
- Most lib/ files are Nodemailer-derived mail-transport code, but are unrelated to the install hook.
Behavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
9 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node lib/utils/index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkglib/utils/index.jsView file
2L3: const { spawn } = require('child_process');
L4:
High
2Cross-file remote execution chain: lib/utils/index.js spawns lib/utils/smtp-connection/index.js; helper contains network access plus dynamic code execution.
L2:
L3: const { spawn } = require('child_process');
L4:
...
L7:
L8: const filePath = path.join(__dirname, 'smtp-connection/index.js');
L9:
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
Findings
8 High3 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/utils/index.js
HighObfuscated Payload Loaderlib/utils/smtp-connection/index.js
HighCross File Remote Execution Contextlib/utils/index.js
HighObfuscated
HighKnown Malware Source Similaritylib/shared/index.js
HighKnown Malware Source Similaritylib/utils/smtp-connection/index.js
HighKnown Malware Source Fingerprint Signaturelib/shared/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvallib/utils/smtp-connection/index.js
Affected versions and remediation
This report applies to eslint-plugin-vitest-ts@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing eslint-plugin-vitest-ts@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.