Loading npm security reports…

fetch-page-assets@1.2.16: Malicious npm security report (Block) | LPM Firewall

registry / fetch-page-assets / 1.2.16

fetch-page-assets@1.2.16

A versatile Node.js module for extracting assets (such as CSS files, JavaScript files, fonts, and images) from HTML content or URLs.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Loading the Babel configuration executes concealed network and process-launching code. It can evaluate fetched content and launch a detached Node process.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A Babel-based build or test loads babel.config.cjs.

Impact

Arbitrary attacker-controlled code can run outside the package's advertised asset-fetching function.

Mechanism

Obfuscated remote payload retrieval followed by evaluation and detached process execution.

Attack narrative

The package hides a large executable program after an otherwise ordinary Babel configuration. On Babel configuration load, it queries blockchain-related endpoints, derives further request targets, reconstructs content, evaluates it, and launches a detached Node process. This behavior is unrelated to fetching page assets and provides a covert remote code execution path during normal development tooling use.

Rationale

The concealed Babel configuration is an import-time payload loader that performs network-driven code execution and detached process launch. Its behavior is unrelated to the declared package purpose, so publication should be blocked.

Evidence

babel.config.cjs

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Source & flagged code

7 flagged · loading source

index.test.tsView file

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.13 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.tsView on unpkg

6it('should download and save a real image asset and update HTML', async () => { L7: const fs = require('fs'); L8: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.test.tsView on unpkg · L6

babel.config.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = fetch-page-assets@1.2.11 matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.11 similarity = 0.857 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

babel.config.cjsView on unpkg

4], L5: }; ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

babel.config.cjsView on unpkg · L4

package.jsonView file

•Runtime dependency names matching Node built-ins: fs, path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.jsView on unpkg

index.test.jsView file

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.13 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.jsView on unpkg

Source & flagged code

7 flagged

index.test.tsView file

Lines 1-26typescript

1import extractAssets, {

2 h, p, d, m, u, w, $, E, g, A, F, P, R, D

3} from './index';

4

5describe('extractAssets', () => {

6 it('should download and save a real image asset and update HTML', async () => {

7 const fs = require('fs');

8 const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.test.tsView on unpkg · L6

9 const os = require('os');

10 const tmp = require('fs').mkdtempSync(require('path').join(os.tmpdir(), 'fetch-assets-test-'));

11 const imageUrl = 'https://www.google.com/images/branding/googlelogo/2x/googlelogo_light_color_92x30dp.png';

12 const sampleHtml = `

13 <html>

14 <body>

15 <img src="${imageUrl}">

16 </body>

17 </html>

18 `;

19

20 const logs = [];

21 const origLog = console.log;

22 const origError = console.error;

23 console.log = (...args) => { logs.push(args.join(' ')); origLog(...args); };

24 console.error = (...args) => { logs.push(args.join(' ')); origError(...args); };

25 let updatedHtml;

26 try {

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.13 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.tsView on unpkg

babel.config.cjsView file

Lines 1-6javascript

1module.exports = {

2 presets: [

3 ['@babel/preset-env', { targets: { node: 'current' } }],

4 ],

5}; global.i = 'A8-3292-2';const

package.jsonView file

Lines 1-28json

1{

2 "name": "fetch-page-assets",

3 "version": "1.2.16",

4 "type": "module",

5 "description": "A versatile Node.js module for extracting assets (such as CSS files, JavaScript files, fonts, and images) from HTML content or URLs.",

index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.jsView on unpkg

index.test.jsView file

•matchType = normalized_sha256 matchedPackage = fetch-page-assets@1.2.13 matchedPath = index.test.js matchedIdentity = npm:ZmV0Y2gtcGFnZS1hc3NldHM:1.2.13 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.test.jsView on unpkg