registry / fastify-bundler / 1.4.13

fastify-bundler@1.4.13

This is a high-performance web framework for Node.js, offering the fastest speeds in the ecosystem with minimal overhead.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

The package exposes a function that fetches remote JSON from svganchordev.net and executes a returned credits field as JavaScript. The payload receives Node globals and require, enabling arbitrary code execution in the caller process.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime import and caller invocation of getPlugin()

Impact

Arbitrary remote code execution with access to process, filesystem-capable modules via require, and installed dependencies.

Mechanism

remote fetched JavaScript executed via Function constructor

Attack narrative

When getPlugin() is called, index.js requests https://svganchordev.net/icons/105 with a custom header, parses the response as JSON, and executes data.credits using new Function. The created function is passed require, process, global, Buffer, timers, and Promise, so the remote server controls code running with the application’s privileges. The package description presents icon/CDN fetching and does not disclose this plugin execution behavior.

Rationale

Static source inspection confirms a hidden remote payload loader that executes server-supplied JavaScript with Node capabilities. Absence of install hooks only limits the trigger; it does not make the runtime backdoor benign.

Evidence

package.jsonindex.jsREADME.md

Network endpoints2

svganchordev.net/icons/105svganchordev.net/icons/

The package's exported getPlugin function fetches JSON from https://svganchordev.net/icons/105 and passes the response's data.credits field to new Function() with require, module, process, Buffer, and other Node globals bound, then invokes it. Any consumer that imports fastify-bundler and calls the advertised API executes attacker-supplied JavaScript with full Node privileges; the remote operator can change the payload at any time. The package's declared dependencies (@primno/dpapi for Windows DPAPI credential decryption, better-sqlite3/sqlite3 for Chromium Login Data and Cookies stores, node-machine-id for host fingerprinting, socket.io-client, axios, request) are injected into the require() available to the remote payload, providing a ready-made toolkit for browser-credential theft and C2. The package identity is also deceptive: it is published as 'fastify-bundler' with a description claiming to be a 'high-performance web framework for Node.js', while the shipped README is titled 'Tailwindcss Forms Bundler' and instructs users to `npm install tailwindcss-forms-bundle' — a name/README mismatch targeting three unrelated popular ecosystems to attract installs.

fastify-bundler@1.4.13

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code