mutex-forge
Mutex and semaphore primitives for synchronizing asynchronous workflows in JavaScript and TypeScript
This report shows the evidence for mutex-forge@2.0.1. 3 of 3 known versions are blocked or flagged. The newest version, 2.0.2, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete malicious runtime behavior unrelated to mutex functionality, including host reporting and remote code execution. Absence of lifecycle hooks does not mitigate the callable backdoor in the default CommonJS entry.
Decision evidence
public snapshot- CommonJS Mutex.runExclusive conditionally launches a detached Node child.
- The launched minified loader imports filesystem, process-spawn, and cryptographic APIs.
- Loader collects host, OS, CPU, memory, and uptime data, then sends reports to Slack and Telegram.
- Obfuscated loader writes/chmods merged data and executes it detached; companion code polls Slack for commands.
- package.json has no preinstall, install, or postinstall hook.
- ES module Mutex implementation lacks the hidden spawn block.
Source & flagged code
6 flagged · loading sourcePackage source references dynamic require/import behavior.
lib/Semaphore.jsView on unpkg · L2Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/withLoad.min.jsView on unpkg · L1The launched minified loader imports filesystem, process-spawn, and cryptographic APIs.
Findings
Affected versions and remediation
This report applies to mutex-forge@2.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing mutex-forge@2.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.