registry / Remote code execution / fetch-page-assets
fetch-page-assets
A versatile Node.js module for extracting assets (such as CSS files, JavaScript files, fonts, and images) from HTML content or URLs.
This report shows the evidence for fetch-page-assets@1.2.16. 8 of 8 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete, obfuscated remote-code loader with an explicit eval and detached process launch. Although it is not install-time, its execution through the package test path is malicious.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Running the package test command or another Babel-based JavaScript transform that loads babel.config.cjs.
Impact
Arbitrary code can run outside the intended asset-extraction functionality and persist as a detached process.
Mechanism
Obfuscated remote payload retrieval followed by eval and detached child-process execution.
Attack narrative
The package disguises a long obfuscated loader as trailing content in its Babel configuration. The declared Jest setup uses babel-jest for JavaScript transforms, causing that configuration to load during tests. The loader queries blockchain or RPC services to derive a destination, requests encoded payload content, builds code from it, calls eval, and also spawns detached Node with the generated code. This is unrelated to fetching page assets and provides remote code execution.
AI rationale
This is a concrete, obfuscated remote-code loader with an explicit eval and detached process launch. Although it is not install-time, its execution through the package test path is malicious.
Evidence
babel.config.cjsjest.config.cjspackage.json
Network endpoints2
ethereum-rpc.publicnode.com1rpc.io/eth
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- babel.config.cjs appends a large obfuscated program after the Babel configuration.
- The hidden program locates a blockchain-derived address, fetches an encoded payload, evaluates it, and starts a detached Node process.
- The test setup routes JavaScript through babel-jest, so running the declared test command loads the malicious Babel configuration.
Evidence against
- package.json has no install or postinstall lifecycle hook.
- The published asset-extraction module is separate from the hidden Babel configuration payload.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
7 flagged · loading sourceindex.test.tsView file
•matchType = normalized_sha256
matchedPackage = fetch-page-assets@1.2.13
matchedPath = index.test.js
matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.13
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
index.test.tsView on unpkg6it('should download and save a real image asset and update HTML', async () => {
L7: const fs = require('fs');
L8: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
index.test.tsView on unpkg · L6babel.config.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = fetch-page-assets@1.2.11
matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.11
similarity = 0.857
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical6 High4 Medium4 Low
CriticalPrevious Version Dangerous Deltababel.config.cjs
HighObfuscated Payload Loaderbabel.config.cjs
HighObfuscated
HighNode Builtin Dependency Squatpackage.json
HighSemantic Analysis Limitedindex.js
HighKnown Malware Source Similarityindex.test.js
HighKnown Malware Source Similarityindex.test.ts
MediumDynamic Requireindex.test.ts
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to fetch-page-assets@1.2.16.
The versions list below shows the verdict for each recorded version.
- Avoid installing fetch-page-assets@1.2.16. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.