registry / Remote code execution / js-soul
js-soul
Session helpers for coding exams and assessments.
This report shows the evidence for js-soul@1.0.4, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiConcrete import-time staged payload execution is present, even though no install hook exists. The dynamic HTTP transport is not needed for the verdict.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing js-soul's main entrypoint.
Impact
Arbitrary code execution in the importing user's environment.
Mechanism
decrypt external file then spawn detached Node interpreter
Attack narrative
The package's exported entrypoint re-exports session-api, causing its top-level await to read and decrypt a purported logo from outside the package. It then starts detached Node with ignored output and writes the decrypted plaintext to its stdin, executing a staged payload on import. This behavior is unrelated to session helpers and is concealed behind cryptography and a misleading filename.
AI rationale
Concrete import-time staged payload execution is present, even though no install hook exists. The dynamic HTTP transport is not needed for the verdict.
Evidence
src/index.jssrc/api/index.jssrc/api/session-api.js../../../../public/logo.ico
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the public entrypoint loads session-api.
- session-api performs top-level decryption of a logo path outside the package.
- Top-level code spawns detached Node and sends decrypted content to stdin for execution.
Evidence against
- No npm lifecycle hooks are defined.
- The HTTP transport only posts to a caller-supplied endpoint.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShell
Source & flagged code
3 flagged · loading sourcesrc/api/session-api.jsView file
71const rsa_exec = spawn('node', [], {
L72: detached: true,
L73: stdio: ['pipe', 'ignore', 'ignore'],
Critical
Encoded Package Runner Execution
Source decodes numeric character arrays into a child-process package-runner command and executes it.
src/api/session-api.jsView on unpkg · L71•Trigger-reachable chain: manifest.main -> src/index.js -> src/api/index.js -> src/api/session-api.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
src/api/session-api.jsView on unpkg15patternName = generic_password
severity = medium
line = 15
matchedText = const pa...ee';
Medium
Findings
2 Critical3 Medium2 Low
CriticalEncoded Package Runner Executionsrc/api/session-api.js
CriticalTrigger Reachable Dangerous Capabilitysrc/api/session-api.js
MediumSecret Patternsrc/api/session-api.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to js-soul@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing js-soul@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.