registry / hatdhat-testkit / 3.2.14

hatdhat-testkit@3.2.14

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Calling the exported middleware starts a detached child that retrieves and executes server-supplied JavaScript. The payload is not present in the package and executes with Node's require capability.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Application calls the exported middleware factory.

Impact

Remote operator can execute arbitrary Node.js code in the host process context.

Mechanism

Detached remote payload fetch followed by dynamic Function execution.

Attack narrative

At runtime, creating the middleware spawns a detached process for lib/caller.js. That file decodes an embedded endpoint, fetches a response field, compiles it with Function, and invokes it with require. This permits the endpoint operator to supply arbitrary code after package publication.

Rationale

This is a concrete staged remote-code-execution chain, not merely a networking or evaluation primitive. Lack of an install hook limits the trigger but does not remove the malicious runtime behavior.

Evidence

index.jslib/caller.jspackage.json

Network endpoints1

api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b036-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f

hatdhat-testkit@3.2.14

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code