registry / isite / 2026.8.26

isite@2026.8.26

OSV Malicious Advisory

scanned 3h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-10735 confirms this npm version as malicious. On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.com/isite (URL hidden by a custom base64-alphabet decoder in object-options/lib/fn.js). Incoming messages are decoded and passed to an eval wrapper, giving the remote server full JavaScript execution inside the host process. In parallel, lib/eval.js's httpTrustedOnline() unconditionally POSTs the...

Advisory

MAL-2026-10735

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in isite (npm)

Details

On initialization of the framework (index.js -> init()), lib/wsClient.js opens a WebSocket to ws://socket.social-browser.com/isite (URL hidden by a custom base64-alphabet decoder in object-options/lib/fn.js). Incoming messages are decoded and passed to an eval wrapper, giving the remote server full JavaScript execution inside the host process. In parallel, lib/eval.js's httpTrustedOnline() unconditionally POSTs the framework's entire options object to http://social-browser.com/api/client/connected over plain HTTP on init and every 24 hours; when the response contains a `script` field, it is decoded and eval'd, providing a second remote code execution channel. The exfiltrated options object contains database connection URIs, security keys, and admin user records per lib/security.js and lib/mongodb.js. A separate helper ____0.AI(text) in apps/client-side/site_files/js/site.js hardcodes POSTs of caller-supplied text to https://n8n.egytag.com/webhook/chat. Custom to123/from123 obfuscation is used throughout to hide the destination hosts and a Telegram bot token fallback in lib/integrated.js. ## Source: ghsa-malware (d11651b520f2288dc8f9557ab19cdf12b9e354eac32128123d0ab634926c5c94) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 159 file(s), 7.33 MB of source, external domains: 127.0.0.1, datatracker.ietf.org, docs.angularjs.org, docs.oasis-open.org, egytag.com, emails.egytag.com, errors.angularjs.org, example.com, git.io, github.com, img.youtube.com, momentjs.com, n8n.egytag.com, openoffice.org, popper.js.org, purl.oclc.org, purl.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.openxmlformats.org, social-browser.com, stackoverflow.com, tools.ietf.org, translate.googleapis.com, vjs.zencdn.net, www.w3.org, www.youtube-nocookie.com, www.youtube.com

Source & flagged code

12 flagged

ssl/key.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

ssl/key.pemView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in ssl/key.pem

ssl/key.pemView on unpkg · L1

tests/static-check.jsView file

3const path = require('node:path'); L4: const cp = require('node:child_process'); L5: const projectRoot = path.resolve(__dirname, '..');

High

Child Process

Package source references child process execution.

tests/static-check.jsView on unpkg · L3

isite_files/js/angular.jsView file

193N=function(a){return C(a)?a.toLowerCase():a},wb=function(a){return C(a)?a.toUpperCase():a},Ba,z,ta,xa=[].slice,vg=[].splice,Xg=[].push,la=Object.prototype.toString,Oc=Object.getPro... L194: "\\$1").replace(/\x08/g,"\\x08")},Ja=function(){if(!t(Ja.rules)){var a=x.document.querySelector("[ng-csp]")||x.document.querySelector("[data-ng-csp]");if(a){var b=a.getAttribute("n... L195: c,e;for(b=0;b<d;++b)if(c=Na[b],a=x.document.querySelector("["+c.replace(":","\\:")+"jq]")){e=a.getAttribute(c+"jq");break}return tb.name_=e},ve=/:/g,Na=["ng-","data-ng-","ng:","x-n...

Low

Eval

Package source references a known benign dynamic code generation pattern.

isite_files/js/angular.jsView on unpkg · L193

proxy.jsView file

1const webServer = require('./index')({ name: 'Local Proxy', apps: false, mongodb: { enabled: false }, require: { features: [] } }); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

proxy.jsView on unpkg · L1

tests/run.jsView file

10try { await fn(); passed++; console.log('PASS', name); } L11: catch (err) { console.error('FAIL', name); console.error(err); process.exitCode = 1; } L12: } ... L24: options: { public: true, require: { features: [], permissions: [] }, defaults: { features: [], permissions: [] }, help: false }, L25: fs, dir: process.cwd(), escapeRegExp: (s) => String(s).replace(/[\/\\^$*+?.()\[\]{}|]/g, '\\$&'), L26: log() {}, fsm: { off() {} }, path, zlib: require('node:zlib'), ... L267: connectCollection: () => collection, on() {}, onPOST() {}, post() {}, all() {}, L268: isFileExistsSync: () => false, dir: os.tmpdir(), fromJson: JSON.parse, readFileSync: () => '', L269: readFile(p, cb) { cb(new Error('no')); }, _x0f1xo: (x) => x, x0md50x: (x) => x, ... L305: const site = { var: (k) => ({ a: 'A' })[k],

Low

Weak Crypto

Package source references weak cryptographic algorithms.

tests/run.jsView on unpkg · L10

lib/service-startup-bundle-nomongo.jsView file

455Cross-file remote execution chain: lib/service-startup-bundle-nomongo.js spawns isite_files/js/client.js; helper contains network access plus dynamic code execution. L455: if (!file.isJson) { L456: file.content = JSON.parse(file.content); L457: file.isJson = true; ... L784: } L785: res.end(); L786: return; ... L2316: ____0.https.globalAgent.options = { L2317: key: ____0.fs.readFileSync(____0.options.https.key || __dirname + '/../ssl/key.pem'), L2318: cert: ____0.fs.readFileSync(____0.options.https.cert || __dirname + '/../ssl/cert.pem'), ... L2359: } L2360: // The outbound integration websocket is not required for the L2361: // HTTP socket to accept requests. Start it after readiness so

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/service-startup-bundle-nomongo.jsView on unpkg · L455

455Detached bundled service listener: lib/service-startup-bundle-nomongo.js launches a Node helper and exposes a broad-bound HTTP listener. L455: if (!file.isJson) { L456: file.content = JSON.parse(file.content); L457: file.isJson = true; ... L784: } L785: res.end(); L786: return; ... L2316: ____0.https.globalAgent.options = { L2317: key: ____0.fs.readFileSync(____0.options.https.key || __dirname + '/../ssl/key.pem'), L2318: cert: ____0.fs.readFileSync(____0.options.https.cert || __dirname + '/../ssl/cert.pem'), ... L2359: } L2360: // The outbound integration websocket is not required for the L2361: // HTTP socket to accept requests. Start it after readiness so

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

lib/service-startup-bundle-nomongo.jsView on unpkg · L455

push.batView file

•path = push.bat kind = build_helper sizeBytes = 56 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

push.batView on unpkg

apps/client-side/site_files/fonts/DroidKufi-Bold.woff2.partView file

•path = apps/client-side/site_files/fonts/DroidKufi-Bold.woff2.part kind = high_entropy_blob sizeBytes = 13861 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

apps/client-side/site_files/fonts/DroidKufi-Bold.woff2.partView on unpkg

apps/client-side/site_files/js/video.min.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

apps/client-side/site_files/js/video.min.jsView on unpkg

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = isite@2026.7.2 matchedIdentity = npm:aXNpdGU:2026.7.2 similarity = 0.495 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

Source & flagged code

12 flagged · loading source

ssl/key.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

ssl/key.pemView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in ssl/key.pem

ssl/key.pemView on unpkg · L1

tests/static-check.jsView file

3const path = require('node:path'); L4: const cp = require('node:child_process'); L5: const projectRoot = path.resolve(__dirname, '..');

High

Child Process

Package source references child process execution.

tests/static-check.jsView on unpkg · L3

Findings

3 Critical6 High6 Medium8 Low

CriticalCritical Secretssl/key.pem

CriticalPrevious Version Dangerous Deltaindex.js

CriticalSecret Patternssl/key.pem

HighChild Processtests/static-check.js

HighShell

HighCross File Remote Execution Contextlib/service-startup-bundle-nomongo.js

HighSpawned Bundled Service Listenerlib/service-startup-bundle-nomongo.js

HighShips High Entropy Blobapps/client-side/site_files/fonts/DroidKufi-Bold.woff2.part

HighSemantic Analysis Limitedapps/client-side/site_files/js/video.min.js

MediumDynamic Requireproxy.js

MediumNetwork

MediumEnvironment Vars