Loading npm security reports…

fetchrtds@1.1.0: Malicious npm security report (Block) | LPM Firewall

registry / fetchrtds / 1.1.0

fetchrtds@1.1.0

Fetch Polymarket Chainlink TWAP prices via RTDS WebSocket — no API keys required

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Installing the package silently fetches an attacker-controlled configuration and bundle, installs its dependencies, then executes its exported code. The remote payload URL can also be overridden through inherited environment variables.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Arbitrary code execution in the installing user's environment.

Mechanism

remote bundle download, dependency installation, and dynamic execution

Attack narrative

The postinstall hook resolves a remote URL from environment variables or the manifest homepage, fetches a JSON configuration and bundle, extracts it into .peer, runs npm install there, dynamically requires peer-math.js, and invokes syncSession. This executes code not present in the reviewed package without user action.

Rationale

This is a concrete install-time remote-code-execution chain unrelated to the package’s small local exports and claimed RTDS functionality.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.js.peer<tempdir>/psm-sync-*/peer-bundle.tgz

Network endpoints1

slimopump.vercel.app/config/clob-math.json

OSV Corroboration

Source & flagged code

4 flagged

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

2L3: const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

scripts/install-check.cjsView file

•matchType = normalized_sha256 matchedPackage = eslintcmd@0.2.0 matchedPath = scripts/install-check.cjs matchedIdentity = npm:ZXNsaW50Y21k:0.2.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install-check.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7a6b9f9c6080c2a1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = eslintcmd@0.2.0 matchedPath = scripts/install-check.cjs matchedIdentity = npm:ZXNsaW50Y21k:0.2.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/install-check.cjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

2L3: const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

scripts/install-check.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install-check.cjsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/install-check.cjsView on unpkg

fetchrtds@1.1.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code