registry / Remote code execution / fetchrtds
fetchrtds
Fetch Polymarket Chainlink TWAP prices via RTDS WebSocket — no API keys required
This report shows the evidence for fetchrtds@1.1.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete install-time remote-code-execution chain unrelated to the package’s small local exports and claimed RTDS functionality.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
npm postinstall
Impact
Arbitrary code execution in the installing user's environment.
Mechanism
remote bundle download, dependency installation, and dynamic execution
Attack narrative
The postinstall hook resolves a remote URL from environment variables or the manifest homepage, fetches a JSON configuration and bundle, extracts it into .peer, runs npm install there, dynamically requires peer-math.js, and invokes syncSession. This executes code not present in the reviewed package without user action.
AI rationale
This is a concrete install-time remote-code-execution chain unrelated to the package’s small local exports and claimed RTDS functionality.
Evidence
package.jsonscripts/install-check.cjsindex.jskelly.js.peer<tempdir>/psm-sync-*/peer-bundle.tgz
Network endpoints1
slimopump.vercel.app/config/clob-math.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json:8 runs the hook on postinstall.
- scripts/install-check.cjs:77-104 accepts env-controlled or homepage config URLs.
- scripts/install-check.cjs:202-204 downloads, extracts, and executes a remote peer module during install.
- scripts/install-check.cjs:183 runs npm install on the downloaded bundle.
- scripts/install-check.cjs:192 dynamically requires .peer/peer-math.js and calls syncSession().
Evidence against
- index.js and kelly.js only export local Kelly-staking helpers.
- No RTDS/WebSocket implementation exists despite the package description and README.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-check.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgindex.jsView file
2L3: const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');
L4:
Medium
scripts/install-check.cjsView file
•matchType = normalized_sha256
matchedPackage = eslintcmd@0.2.0
matchedPath = scripts/install-check.cjs
matchedIdentity = npm:ZXNsaW50Y21k:0.2.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Findings
3 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Similarityscripts/install-check.cjs
HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to fetchrtds@1.1.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing fetchrtds@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.