registry / js-array-tokens / 1.0.2

js-array-tokens@1.0.2

js tokens array

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Importing the package retrieves code from a remote endpoint and executes it. The remote operator can change the executed payload at any time.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing or requiring the package entry point.

Impact

Arbitrary JavaScript can run with the permissions of the consuming application.

Mechanism

Remote payload fetch followed by eval.

Attack narrative

The package entry point calls getToken immediately. It reconstructs a remote URL from character codes, fetches a JSON token, and evaluates that token as JavaScript. This gives the remote endpoint control over code executed by any application that imports the package.

Rationale

The package contains import-time remote code execution through eval, which is a concrete malicious execution chain. The absence of lifecycle scripts does not mitigate runtime compromise of consumers.

Evidence

package.jsonindex.js

Network endpoints1

access-token-delta.vercel.app/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

js-array-tokens@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code