registry / fetch-page-assets / 1.2.14

fetch-page-assets@1.2.14

A versatile Node.js module for extracting assets (such as CSS files, JavaScript files, fonts, and images) from HTML content or URLs.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Loading the Babel configuration triggers an obfuscated remote-payload chain. The chain evaluates generated code and can detach a Node subprocess.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Babel configuration load, including Babel/Jest transformation.

Impact

Remote code execution and background process execution in the developer environment.

Mechanism

obfuscated remote payload retrieval followed by eval and detached spawn

Attack narrative

The appended top-level Babel-config payload runs when the config is loaded. It builds network targets, accepts an ETH_RPC_URL override, obtains encoded remote content, then evaluates constructed code and launches a detached Node process. This is unrelated to page-asset extraction and provides a concealed remote-code-execution path.

Rationale

The source contains a concrete, top-level obfuscated loader with remote input flowing to eval and detached child-process execution. Absence of an install hook limits automatic activation but does not negate malicious behavior.

Evidence

babel.config.cjsjest.config.cjspackage.jsonindex.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

fetch-page-assets@1.2.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code