registry / Remote code execution / gamified-trading-system
gamified-trading-system
Adds simple game features like rewards and levels to make trading more engaging.
This report shows the evidence for gamified-trading-system@3.6.2. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiSource inspection confirms a concrete remote code execution loader unrelated to the advertised package purpose. Absence of install hooks lowers automatic execution risk, but user-invoked package use activates the malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
User imports/calls the default export from index.js.
Impact
Arbitrary code execution in the consumer process; remote payload could access files, environment, credentials, or network.
Mechanism
remote JSON payload executed with Function constructor
Attack narrative
The package does not implement the gamified trading functionality it advertises. Its default export builds a request to svganchordev.net/icons/116, parses JSON, and passes data.credits into new Function with require, process, Buffer, globalThis, and timers, creating a remote arbitrary-code execution path when the API is used.
AI rationale
Source inspection confirms a concrete remote code execution loader unrelated to the advertised package purpose. Absence of install hooks lowers automatic execution risk, but user-invoked package use activates the malicious behavior.
Evidence
package.jsonindex.jsREADME.md
Network endpoints7
svganchordev.net/icons/116cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/svgs/brands/cdnjs.fastly.net/ajax/libs/font-awesome/6.4.0/svgs/brands/cdnjs.akamai.net/ajax/libs/font-awesome/6.4.0/svgs/brands/cdnjs.cloudfront.net/ajax/libs/font-awesome/6.4.0/svgs/brands/cdnjs.gcorelabs.com/ajax/libs/font-awesome/6.4.0/svgs/brands/cdnjs.keyIcon.com/ajax/libs/font-awesome/6.4.0/svgs/brands/
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js exports getPlugin, which fetches JSON from https://svganchordev.net/icons/116 by default.
- index.js executes remote data.credits via new Function with require, process, Buffer, timers, and globalThis.
- README.md advertises trading APIs updateProgress/getLeaderboard that are not implemented by index.js.
- package.json includes sensitive-capability dependencies (@primno/dpapi, sqlite, node-machine-id, socket.io-client) unused by visible code.
Evidence against
- package.json has no install/preinstall/postinstall lifecycle scripts.
- No local file writes, credential reads, child_process calls, or persistence code are present in package source.
Behavioral surface
EvalNetwork
Source & flagged code
1 flagged · loading sourceindex.jsView file
149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
Findings
1 High1 Medium1 Low
HighEvalindex.js
MediumNetwork
LowScripts Present
Affected versions and remediation
This report applies to gamified-trading-system@3.6.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing gamified-trading-system@3.6.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.