registry / items-validator / 1.0.4

items-validator@1.0.4

Real-time game items validator with background daemon for client project updates

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the package launches a detached daemon that downloads and executes remote code. Signature verification does not constrain code chosen by the package-controlled signing service.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Requiring the package entry point.

Impact

The remote service can execute arbitrary Node.js code in the consuming user's environment.

Mechanism

A detached child runs lib/check-items.js, fetches code from the fixed endpoint, verifies its signature, and evaluates it with Function.

Attack narrative

The package executes behavior on import rather than exposing only validation functions. Its entry point launches a detached process that retrieves a remotely controlled payload and evaluates it with Node.js access to require. The signature check merely lets the remote signing service authorize the payload; the included server example shows that service returning code plus a signature. This is an active remote-code-execution channel for package consumers.

AI rationale

The package contains an import-triggered, detached remote payload loader that executes server-authorized JavaScript. This is concrete remote code execution, not ordinary item validation.

Evidence

index.jslib/check-items.jsSERVER_IMPLEMENTATION_EXAMPLE.js

Network endpoints1

game.spawnrealm.com/api/item-realtime?key=abc123def456

On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.

items-validator@1.0.4

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code