registry / items-validator / 1.0.5

items-validator@1.0.5

Real-time game items validator with background daemon for client project updates

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The package creates a background daemon merely when imported. That daemon downloads operator-controlled signed code and executes it.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the package loads index.js.

Impact

The remote signing-key holder can run arbitrary JavaScript in the consuming environment without a direct user action.

Mechanism

The entrypoint spawns a detached daemon; the daemon fetches a payload, verifies its signature, and passes its code to Function.

Attack narrative

A normal import launches a detached process that contacts the package-controlled service. The service response contains JavaScript that is executed after signature validation. Signature validation prevents third-party tampering but leaves the remote key holder able to change code executed on every importing machine.

AI rationale

The import-time daemon and remote Function execution form an active remote-code-execution path. The cryptographic check authenticates the operator payload rather than constraining its capabilities.

Evidence

index.jslib/check-items.js

Network endpoints1

game.spawnrealm.com

OSV advisory

OpenSSF/OSV

On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.

items-validator@1.0.5

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code