ishowfeet19
Republished package
This report shows the evidence for ishowfeet19@2.0.0. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package is a browser payload, not a normal npm library: opening its main entrypoint causes remote code execution and automatic browser traffic/cookie proxying. This is concrete malicious runtime behavior despite the lack of install hooks.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening `index.html` in a browser.
Impact
A remote operator can change executed code; the proxy can intercept routed browser requests and handle cookies.
Mechanism
Remote script execution plus automatic service-worker traffic and cookie proxying.
Attack narrative
Although npm installation itself has no lifecycle hook, the declared HTML entrypoint immediately imports an externally hosted script, then the app automatically registers a service worker. That worker claims browser clients and sends routed requests through an embedded Scramjet-style proxy configured with a WebSocket endpoint on an unrelated host. Its injected client includes cookie synchronization with the service worker. This creates an unconsented, remotely controllable browser interception surface, with obfuscation reducing auditability.
AI rationale
The package is a browser payload, not a normal npm library: opening its main entrypoint causes remote code execution and automatic browser traffic/cookie proxying. This is concrete malicious runtime behavior despite the lack of install hooks.
Evidence
package.jsonindex.htmlassets/boot-CVPGRFHh.jsj6k3y8.jsct1tl/csbzam.jsct1tl/jmqwjq.jsbfjdx/757lr8.jsbfjdx/w7m632.wasm
Network endpoints2
c.vipersfutbol.com/script.jswss://21baseballacademy.com/fairs/
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.html` auto-loads `https://c.vipersfutbol.com/script.js`.
- `assets/boot-CVPGRFHh.js` registers `j6k3y8.js` without user action.
- `j6k3y8.js` claims clients and routes fetches through `_19vij0x`.
- `assets/boot-CVPGRFHh.js` configures proxy WebSocket `wss://21baseballacademy.com/fairs/`.
- `ct1tl/csbzam.js` synchronizes proxied cookies through the service worker.
- Obfuscated primary app assets conceal the automatic boot path.
Evidence against
- `package.json` contains no preinstall/install/postinstall hooks.
- No Node filesystem, shell, or environment-harvesting behavior was found.
- No explicit credential-exfiltration request was identified in inspected sources.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Source & flagged code
7 flagged · loading sourceassets/proxy-runtime-1NyFshf9.jsView file
1patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L11patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Secret Pattern
AWS access key ID in assets/proxy-runtime-1NyFshf9.js
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1bfjdx/757lr8.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Findings
2 Critical3 High6 Medium4 Low
CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js
CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js
HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js
HighObfuscated
HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2
MediumDynamic Requirebfjdx/757lr8.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebfjdx/w7m632.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patternassets/livekit-C0E_jLSz.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to ishowfeet19@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing ishowfeet19@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.