registry / eslint-plugin-vitest-ts / 1.0.4

eslint-plugin-vitest-ts@1.0.4

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Installation launches a detached child process that retrieves and executes remote JavaScript. The remote payload can use Node require.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Arbitrary code execution on the installing machine; payload behavior is remotely changeable.

Mechanism

detached remote payload loader with dynamic code execution

Attack narrative

During npm postinstall, the package starts a detached Node child process. That process reads a concealed local payload file, then fetches JSON from JSONBin and compiles the response's record.cookie field through new Function, supplying require. This gives a remotely controlled payload arbitrary Node module access on the installer machine and lets the attacker alter behavior after publication.

Rationale

The install-time detached loader fetches and executes attacker-controlled remote code, which is concrete malicious behavior unrelated to an ESLint plugin.

Evidence

package.jsonlib/utils/index.jslib/utils/smtp-connection/index.jslib/utils/smtp-connection/LICENSElib/utils/smtp-connection/parse.js

Network endpoints1

api.jsonbin.io/v3/b/6a72aa2bda38895dfebb1302

OSV Corroboration

The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader. package.json's postinstall hook runs `node lib/utils/index.js`, which spawns a detached child process executing lib/utils/smtp-connection/index.js. That file uses obfuscator.io-style string-array indirection (`_0x438c`, `_0x926305`, etc.) to hide a call that fetches JSON from https://api.jsonbin.io/v3/b/6a72aa2bda38895dfebb1302 and passes the returned `record.cookie` string to `new Function('require', <fetched>)(require)`. The fetched content is attacker-controlled and mutable, and it executes in-process with `require` injected, giving arbitrary code execution on any machine that runs `npm install` for this package. The name `eslint-plugin-vitest-ts` is unrelated to the shipped nodemailer-shaped source, indicating a lure/typosquat. ## Source: ghsa-malware (24c2db5f1e6400e1a774b0a542c8cb8cd6aad001e80068c6aeb97ebc6af3c2d0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

eslint-plugin-vitest-ts@1.0.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code