registry / Remote code execution / log-min
log-min
JavaScript library for interacting with the Theta Blockchain
This report shows the evidence for log-min@1.0.13, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package contains an unconsented install-time and import-time concealed arbitrary-code execution chain. The blockchain library functionality does not justify this detached decrypted payload launcher.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm postinstall, or importing the package entrypoint
Impact
Arbitrary concealed JavaScript executes without user invocation and survives the parent process detaching.
Mechanism
decrypts dependency-supplied payload and executes it through detached Node
Attack narrative
During postinstall, `node src` resolves src/index.js, which imports BaseProvider. Its module initialization decrypts a ciphertext obtained from `thedata`, starts a detached Node process, and supplies the decrypted value as executable stdin. The same behavior is embedded in every runtime distribution entrypoint, so ordinary import also triggers it. Payload content is intentionally hidden outside the package source.
AI rationale
The package contains an unconsented install-time and import-time concealed arbitrary-code execution chain. The blockchain library functionality does not justify this detached decrypted payload launcher.
Evidence
package.jsonsrc/index.jssrc/providers/BaseProvider.jsdist/log-min.cjs.jsdist/log-min.esm.jsdist/log-min.umd.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json postinstall runs `node src`.
- src/providers/BaseProvider.js imports an opaque `desKey` from `thedata` and decrypts it with DES.
- That module immediately spawns detached `node`, pipes the decrypted text to stdin, and unrefs it.
- BaseProvider is imported by src/index.js; the same import-time launcher is present in all dist entrypoints.
Evidence against
- The remaining provider code implements Theta blockchain RPC operations.
- No plaintext payload endpoint is present; execution content is concealed in dependency-supplied ciphertext.
Behavioral surface
ChildProcessCryptoFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node src
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node src
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgdist/log-min.umd.jsView file
1(function (global, factory) {
L2: typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('node:fs'), require('node:url'), require('child_process')) :
L3: typeof define === 'function' && define.amd ? define(['exports', 'node:fs', 'node:url', 'child_process'], factory) :
...
L151: let hex = "0x";
L152: for (let i = 0; i < ascii.length; ++i) hex += ("00" + ascii.charCodeAt(i).toString(16)).slice(-2);
L153: return hex;
...
L161:
L162: // From https://gist.github.[redacted]
L163: const fromString = s => {
...
L615: *
L616: * @private
L617: * @param {*} value The value to query.
Findings
2 Critical3 High3 Medium4 Low
CriticalSpawned Remote Code Executiondist/log-min.umd.js
CriticalTrigger Reachable Dangerous Capabilitydist/log-min.cjs.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/log-min.umd.js
HighShell
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to log-min@1.0.13.
The versions list below shows the verdict for each recorded version.
- Avoid installing log-min@1.0.13. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.