registry / Remote code execution / notifier-funcs
notifier-funcs
Enable Notifications
This report shows the evidence for notifier-funcs@1.3.4, the only known version.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe package contains a concrete remote payload loader and evaluator reached through its public API. Absence of an install hook does not mitigate this runtime RCE behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls the package's exported `check()` function.
Impact
Remote operators can execute arbitrary code with the consuming process user's permissions.
Mechanism
Detached child fetches and evaluates remote JavaScript with `require`.
Attack narrative
Calling `check()` in `index.js` starts a detached Node process for `lib/vcall.js`. That file downloads a server-controlled `model` value from api.jsonsilo.com, compiles it through `Function.constructor`, and invokes it with Node's `require`. The server can therefore supply arbitrary JavaScript that loads local modules and performs actions under the application's user account; the detached child makes execution less visible to the caller.
AI rationale
The package contains a concrete remote payload loader and evaluator reached through its public API. Absence of an install hook does not mitigate this runtime RCE behavior.
Evidence
package.jsonindex.jslib/vcall.js.env
Network endpoints1
api.jsonsilo.com/public/c6c0b393-932f-4ae1-8fca-23c6747f4acc
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` launches detached `node lib/vcall.js` when exported `check()` is called.
- `lib/vcall.js` fetches a `model` field from a remote API.
- `lib/vcall.js` compiles and executes fetched text using `new Function.constructor`.
- The remote payload executes with local `require`, enabling arbitrary module access.
- The child is detached and unreferenced, allowing execution after the caller exits.
Evidence against
- `package.json` has no npm lifecycle hooks.
- No AI-agent configuration or install-time filesystem mutation was found.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading source.envView file
2patternName = blocked_file
severity = critical
matchedText = .env
redactedSecretContext =
secretLikeLines = 1
L2: DEV_DEPENDENCY_TOKEN=<redacted:4 value>
Critical
docs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
1 Critical3 Medium3 Low
CriticalCritical Secret.env
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to notifier-funcs@1.3.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing notifier-funcs@1.3.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.