registry / Remote code execution / modsync
modsync
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for modsync@5.0.2, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe import-time payload is intentionally concealed and combines networking with execSync/spawn and filesystem access. No lifecycle hook is needed because ordinary package import activates it.
Static reason
High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review
Trigger
Import or require of modsync's main entrypoint.
Impact
Remote content can drive local command execution and filesystem access in the importing process.
Mechanism
Obfuscated network-enabled command-execution loader
Attack narrative
A normal require of the declared main entry synchronously imports lib/config.js. That single-line, heavily obfuscated payload establishes dynamic Function access, imports filesystem and child-process execution primitives, and imports axios and crypto for networked operations. This is unrelated to the exported no-op middleware and conceals a network-to-local-execution capability from consumers.
AI rationale
The import-time payload is intentionally concealed and combines networking with execSync/spawn and filesystem access. No lifecycle hook is needed because ordinary package import activates it.
Evidence
package.jsonindex.jslib/config.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Main entry imports the opaque payload during normal package import.
- Payload imports fs plus child_process execSync/spawn and registers process handlers.
- Payload imports axios and crypto; it also rewrites HTTP(S) URLs.
- Payload uses Function-based global resolution and is heavily obfuscated.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The exported middleware itself only calls next(), but its module load already imports the payload.
Behavioral surface
ChildProcessEnvironmentVars
HighEntropyStringsMinifiedUrlStrings
Oversized source lightweight scan
lib/config.js3.91 MB file, sampled 256 KB
HighEntropyStrings
Source & flagged code
7 flagged · loading sourceindex.jsView file
3const path = require('path');
L4: const { spawn } = require('child_process');
L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');
High
lib/config.jsView file
1function yW(F,S,Y,E,i){const FB={F:0x2f4};return T(i-FB.F,F);}function yx(F,S,Y,E,i){const FN={F:0x32d};return j(S- -FN.F,Y);}(function(F,S){const Fn={F:0x620b,S:0x51ad,Y:'\x36\x39...
Critical
Download Execute
Source downloads or fetches remote code and executes it.
lib/config.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> index.js -> lib/config.js
L1: function yW(F,S,Y,E,i){const FB={F:0x2f4};return T(i-FB.F,F);}function yx(F,S,Y,E,i){const FN={F:0x32d};return j(S- -FN.F,Y);}(function(F,S){const Fn={F:0x620b,S:0x51ad,Y:'\x36\x39...
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
Findings
2 Critical5 High2 Medium3 Low
CriticalDownload Executelib/config.js
CriticalTrigger Reachable Dangerous Capabilitylib/config.js
HighChild Processindex.js
HighSemantic Analysis Limitedlib/config.js
HighKnown Malware Source Fingerprint Signaturelib/tools.js
HighAi Review Evidencelib/config.js
HighAi Review Evidencelib/config.js
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to modsync@5.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing modsync@5.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.