Loading npm security reports…

fetch-page-assets@1.2.13: Malicious npm security report (Block) | LPM Firewall

registry / fetch-page-assets / 1.2.13

fetch-page-assets@1.2.13

A versatile Node.js module for extracting assets (such as CSS files, JavaScript files, fonts, and images) from HTML content or URLs.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Obfuscated code appended to the Babel config acts as a remote payload loader. When the config is executed, it can evaluate fetched content and launch detached Node code.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Babel configuration execution, including a Babel/Jest transformation workflow such as the package-defined test command.

Impact

Arbitrary remote code execution in the developer or CI environment.

Mechanism

Obfuscated network loader invoking eval and detached child-process execution.

Attack narrative

A large obfuscated payload is appended to babel.config.cjs, a configuration file normally expected to contain only Babel settings. It initializes HTTP/S clients and a child-process spawn primitive, reads an RPC environment setting, derives remote control data, then evaluates a constructed payload and starts a detached node -e process. The package exposes a Jest test workflow with babel-jest transforms, creating a package-provided route that can load the malicious configuration during development or CI.

Rationale

The appended Babel-config payload is unrelated to asset extraction and contains an explicit remote code-execution chain. Absence of install hooks reduces automatic-install exposure but does not negate the concrete malicious execution path.

Evidence

babel.config.cjspackage.jsonjest.config.cjs

Decision evidence

Source & flagged code

9 flagged · loading source

index.test.tsView file

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.14 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.tsView on unpkg

6it('should download and save a real image asset and update HTML', async () => { L7: const fs = require('fs'); L8: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.test.tsView on unpkg · L6

babel.config.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = fetch-page-assets@1.2.11 matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.11 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

babel.config.cjsView on unpkg

4], L5: }; ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

babel.config.cjsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.14 matchedPath = babel.config.cjs matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

babel.config.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 572ed4a09604179e signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = fetch-page-assets@1.2.14 matchedPath = babel.config.cjs matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.14 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

babel.config.cjsView on unpkg

package.jsonView file

•Runtime dependency names matching Node built-ins: fs, path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.jsView on unpkg

index.test.jsView file

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.14 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.jsView on unpkg

Source & flagged code

9 flagged

index.test.tsView file

Lines 1-26typescript

1import extractAssets, {

2 h, p, d, m, u, w, $, E, g, A, F, P, R, D

3} from './index';

4

5describe('extractAssets', () => {

6 it('should download and save a real image asset and update HTML', async () => {

7 const fs = require('fs');

8 const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.test.tsView on unpkg · L6

9 const os = require('os');

10 const tmp = require('fs').mkdtempSync(require('path').join(os.tmpdir(), 'fetch-assets-test-'));

11 const imageUrl = 'https://www.google.com/images/branding/googlelogo/2x/googlelogo_light_color_92x30dp.png';

12 const sampleHtml = `

13 <html>

14 <body>

15 <img src="${imageUrl}">

16 </body>

17 </html>

18 `;

19

20 const logs = [];

21 const origLog = console.log;

22 const origError = console.error;

23 console.log = (...args) => { logs.push(args.join(' ')); origLog(...args); };

24 console.error = (...args) => { logs.push(args.join(' ')); origError(...args); };

25 let updatedHtml;

26 try {

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.14 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.tsView on unpkg

babel.config.cjsView file

Lines 1-6javascript

1module.exports = {

2 presets: [

3 ['@babel/preset-env', { targets: { node: 'current' } }],

4 ],

5}; global.i="A8-3292-1";

package.jsonView file

Lines 1-28json

1{

2 "name": "fetch-page-assets",

3 "version": "1.2.13",

4 "type": "module",

5 "description": "A versatile Node.js module for extracting assets (such as CSS files, JavaScript files, fonts, and images) from HTML content or URLs.",

index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.jsView on unpkg

index.test.jsView file

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.14 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.14 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.jsView on unpkg