registry / ezdiscordbots / 1.0.2

ezdiscordbots@1.0.2

Free-to-use package to make your own discord bot.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

npm installation invokes a privileged installer that registers persistent execution of index.js. The runtime code detaches and re-executes itself when not already under the service manager.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall, then system service startup

Impact

Unconsented persistent execution of obfuscated package code with elevated installation context.

Mechanism

privileged system-service persistence and detached self-relaunch

Attack narrative

Installing the package runs `sudo node install.js`. That obfuscated installer constructs a node-linux Service whose script is index.js, installs it, and configures restart behavior. index.js recognizes service-manager context through INVOCATION_ID and otherwise spawns a detached copy of itself before exiting. This is an unconsented persistence chain, not functionality needed for a Discord-bot library.

Rationale

The package establishes a persistent system service during postinstall and hides the implementation with heavy obfuscation. This is concrete malicious install-time persistence.

Evidence

package.jsoninstall.jsindex.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13377

Source

OpenSSF Malicious Packages via OSV

Summary

package.json declares a postinstall script `sudo node install.js` that runs install.js with root privileges on the installer's machine. Both install.js and index.js are heavily obfuscated (js-virtualizer / obfuscator.io family): hex-mangled identifiers, rotated string array, control-flow flattening, anti-debug regex checks, and a base64/percent-decoded string reconstructor. index.js concatenates four decoder-produced fragments and passes the result through Buffer.from(dora, 'base64').toString() at module load to materialize executable content that is not visible in the shipped source. The declared runtime dependencies include js-virtualizer (obfuscator) and node-linux (systemd/init daemon registration) — neither has any connection to the advertised Discord bot purpose, and node-linux provides the primitives to install a persistent root-level daemon. The combination of sudo-elevated postinstall, obfuscated self-decoding payload, and a Linux service-installer dependency is the canonical install-time RCE / persistence shape; installing this package causes attacker-controlled code to execute as root on the installer host.

ezdiscordbots@1.0.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code