Loading npm security reports…

log-min@1.0.13: Malicious npm security report (Block) | LPM Firewall

registry / log-min / 1.0.13

log-min@1.0.13

JavaScript library for interacting with the Theta Blockchain

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Installation loads src/index.js, which imports BaseProvider and starts a detached Node child with decrypted concealed input. Importing any published JS entrypoint also reaches the same launcher.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall, or importing the package entrypoint

Impact

Arbitrary concealed JavaScript executes without user invocation and survives the parent process detaching.

Mechanism

decrypts dependency-supplied payload and executes it through detached Node

Attack narrative

During postinstall, `node src` resolves src/index.js, which imports BaseProvider. Its module initialization decrypts a ciphertext obtained from `thedata`, starts a detached Node process, and supplies the decrypted value as executable stdin. The same behavior is embedded in every runtime distribution entrypoint, so ordinary import also triggers it. Payload content is intentionally hidden outside the package source.

Rationale

The package contains an unconsented install-time and import-time concealed arbitrary-code execution chain. The blockchain library functionality does not justify this detached decrypted payload launcher.

Evidence

package.jsonsrc/index.jssrc/providers/BaseProvider.jsdist/log-min.cjs.jsdist/log-min.esm.jsdist/log-min.umd.js

Decision evidence

public snapshot

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node src

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/log-min.umd.jsView file

1(function (global, factory) { L2: typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('node:fs'), require('node:url'), require('child_process')) : L3: typeof define === 'function' && define.amd ? define(['exports', 'node:fs', 'node:url', 'child_process'], factory) : ... L151: let hex = "0x"; L152: for (let i = 0; i < ascii.length; ++i) hex += ("00" + ascii.charCodeAt(i).toString(16)).slice(-2); L153: return hex; ... L161: L162: // From https://gist.github.[redacted] L163: const fromString = s => { ... L615: * L616: * @private L617: * @param {*} value The value to query.

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/log-min.umd.jsView on unpkg · L1

1(function (global, factory) { L2: typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('node:fs'), require('node:url'), require('child_process')) : L3: typeof define === 'function' && define.amd ? define(['exports', 'node:fs', 'node:url', 'child_process'], factory) :

High

Child Process

Package source references child process execution.

dist/log-min.umd.jsView on unpkg · L1

dist/log-min.cjs.jsView file

16Trigger-reachable chain: manifest.main -> dist/log-min.cjs.js L16: var CryptoJS = _interopDefault(require('crypto-js')); L17: var child_process = _interopDefault(require('child_process')); L18: var ethers = require('ethers'); ... L196: L197: const makeSigner = addToV => (hash$$1, privateKey) => { L198: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L242: toJson(){ L243: return JSON.parse(JSON.stringify({ L244: txType: this.getType(), L245: txData: this._rawTx L246: })); ... L361:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/log-min.cjs.jsView on unpkg · L16

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node src

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node src

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/log-min.umd.jsView file

1(function (global, factory) { L2: typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('node:fs'), require('node:url'), require('child_process')) : L3: typeof define === 'function' && define.amd ? define(['exports', 'node:fs', 'node:url', 'child_process'], factory) : ... L151: let hex = "0x"; L152: for (let i = 0; i < ascii.length; ++i) hex += ("00" + ascii.charCodeAt(i).toString(16)).slice(-2); L153: return hex; ... L161: L162: // From https://gist.github.[redacted] L163: const fromString = s => { ... L615: * L616: * @private L617: * @param {*} value The value to query.

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/log-min.umd.jsView on unpkg · L1

1(function (global, factory) { L2: typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('node:fs'), require('node:url'), require('child_process')) : L3: typeof define === 'function' && define.amd ? define(['exports', 'node:fs', 'node:url', 'child_process'], factory) :

High

Child Process

Package source references child process execution.

dist/log-min.umd.jsView on unpkg · L1

dist/log-min.cjs.jsView file

16Trigger-reachable chain: manifest.main -> dist/log-min.cjs.js L16: var CryptoJS = _interopDefault(require('crypto-js')); L17: var child_process = _interopDefault(require('child_process')); L18: var ethers = require('ethers'); ... L196: L197: const makeSigner = addToV => (hash$$1, privateKey) => { L198: const ecKey = secp256k1.keyFromPrivate(new Buffer(privateKey.slice(2), "hex")); ... L242: toJson(){ L243: return JSON.parse(JSON.stringify({ L244: txType: this.getType(), L245: txData: this._rawTx L246: })); ... L361:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/log-min.cjs.jsView on unpkg · L16