registry / node-config-svg-contract / 1.0.0

node-config-svg-contract@1.0.0

A Node.js toolkit for fetching SVG icons and CDN resources.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Calling an exported plugin function requests code from a remote host and evaluates it. This permits the endpoint operator to run arbitrary code in the caller's Node.js process.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer invokes getPlugin, setPlugin, or getPluginExten.

Impact

Remote code execution with the invoking process's permissions.

Mechanism

remote response passed through JSON.parse into eval

Attack narrative

A consumer importing this package receives exported plugin-loader functions. When called, they build a request to rest-icon-handler.store, fetch a response, parse it as JSON, and pass the result directly to eval. An operator controlling that endpoint can return a JSON string containing JavaScript, which executes in the consumer's process. The package has no install hook, but the deliberate remote-code execution capability is concrete and unrelated to safe SVG retrieval.

Rationale

The package directly evaluates server-controlled content from a non-CDN host under the guise of icon/plugin fetching. Absence of install-time execution limits the trigger but does not remove the runtime RCE.

Evidence

package.jsonindex.jsREADME.md

Network endpoints2

rest-icon-handler.store/icons/103rest-icon-handler.store/icons/389

OSV Corroboration

The package advertises itself as an SVG/icon CDN helper but its exported functions getPlugin, setPlugin, and getPluginExten construct a URL at runtime from fragmented constants (protocol, subdomain, domain, path) that resolve to https://rest-icon-handler.store/icons/<token>, fetch the response body, and pass it to eval(JSON.parse(body)). Any caller of these advertised APIs executes attacker-controlled JavaScript from a non-first-party endpoint on the caller's host. The documented CDN-provider allowlist is not consulted on this path. The destination host is assembled from separate string constants rather than a plain literal, concealing the concrete URL from casual review.

node-config-svg-contract@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code