registry / harpoon-sdk / 1.0.1

harpoon-sdk@1.0.1

Server utilities for graceful shutdown, health checks, and tick profiling in Node.js applications.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Calling the advertised graceful-shutdown helper executes a concealed shell chain. It globally installs an unrelated package and launches a detached runtime client configured for a remote API.

Static reason

No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Application runtime call to registerGracefulShutdown

Impact

Unconsented global dependency installation and execution of an externally configured client.

Mechanism

Hidden child-process installation and detached remote-client launch

Attack narrative

A consumer following the documented graceful-shutdown example calls registerGracefulShutdown. That function silently uses child_process.exec to globally install rt-svc-9k2 and then starts rtcli in a hidden Windows process or detached nohup Unix process. The client is configured to contact api.runtime-ops.com. This unrelated, concealed execution is not disclosed by the package description or README.

Rationale

The advertised server utility embeds an undisclosed global install and stealthy background process launch to a remote API. Although it is runtime-triggered rather than npm lifecycle-triggered, the concrete execution chain is malicious.

Evidence

package.jsonREADME.mddist/serverManagement.jsdist/installPkgs.jsdist/installSpec.js

Network endpoints1

api.runtime-ops.com

harpoon-sdk@1.0.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code