registry / Remote code execution / node-config-svg-contract
node-config-svg-contract
A Node.js toolkit for fetching SVG icons and CDN resources.
This report shows the evidence for node-config-svg-contract@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package directly evaluates server-controlled content from a non-CDN host under the guise of icon/plugin fetching. Absence of install-time execution limits the trigger but does not remove the runtime RCE.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer invokes getPlugin, setPlugin, or getPluginExten.
Impact
Remote code execution with the invoking process's permissions.
Mechanism
remote response passed through JSON.parse into eval
Attack narrative
A consumer importing this package receives exported plugin-loader functions. When called, they build a request to rest-icon-handler.store, fetch a response, parse it as JSON, and pass the result directly to eval. An operator controlling that endpoint can return a JSON string containing JavaScript, which executes in the consumer's process. The package has no install hook, but the deliberate remote-code execution capability is concrete and unrelated to safe SVG retrieval.
AI rationale
The package directly evaluates server-controlled content from a non-CDN host under the guise of icon/plugin fetching. Absence of install-time execution limits the trigger but does not remove the runtime RCE.
Evidence
package.jsonindex.jsREADME.md
Network endpoints2
rest-icon-handler.store/icons/103rest-icon-handler.store/icons/389
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Exported plugin functions fetch an opaque remote response and execute its JSON-parsed contents with eval.
- The remote payload endpoint is constructed as https://rest-icon-handler.store/icons/ followed by built-in or caller-controlled tokens.
- The same remote-eval pattern appears in getPlugin, getPluginExten, and setPlugin.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Importing the module only loads request; network/eval occur when an exported plugin function is called.
- No source evidence of local file access, credential harvesting, or child-process execution.
Behavioral surface
EvalNetwork
Source & flagged code
2 flagged · loading sourceindex.jsView file
46try {
L47: const data = JSON.parse(body);
L48: resolve(data);
...
L57: if (typeof navigator === "undefined") {
L58: if (typeof process !== "undefined" && process.platform) {
L59: return process.platform === "win32";
...
L118: try {
L119: eval(JSON.parse(b));
L120: } catch (err) {
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L46118try {
L119: eval(JSON.parse(b));
L120: } catch (err) {
High
Findings
1 Critical1 High2 Medium1 Low
CriticalRemote Response Code Executionindex.js
HighEvalindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to node-config-svg-contract@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing node-config-svg-contract@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.