registry / npm-groat / 1.1.1

npm-groat@1.1.1

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Installation invokes dist/config.js. It contains a remote-controlled global function invocation, but its syntax/runtime errors prevent execution as shipped.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Potential remote code execution if repaired or made executable; installation currently fails before the fetch.

Mechanism

remote response drives a globalThis call

Rationale

The install-time remote-controlled invocation is unrelated to the advertised library and is a credible staged payload pattern. Because the shipped code cannot execute under the declared CommonJS configuration, warn rather than block.

Evidence

package.jsondist/config.jssrc/index.jsdist/index.js

Network endpoints1

my-api.trade-api.workers.dev?id=0

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12798

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in npm-groat (npm)

Details

npm-groat@1.1.1 declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to https://my-api.trade-api.workers.dev?id=0 and then evaluates the response by calling globalThis[data.success](data.id) — treating attacker-controlled JSON fields as the name of a global function (e.g. eval or Function) and its argument. This gives the remote endpoint arbitrary code execution on the installer's host during package installation. The same file also contains a bare globalThis[tag](text) referencing undeclared identifiers, consistent with a dead-drop stager rather than legitimate configuration. The package's advertised purpose has no need to contact a remote server at install time.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for block

package.json runs dist/config.js as postinstall.
dist/config.js fetches https://my-api.trade-api.workers.dev?id=0.
Remote response controls a globalThis function name and argument.
The package’s money-helper source has no legitimate need for this lifecycle network code.

Evidence against

No credential, file-harvesting, child-process, or persistence code was found.
dist/config.js is incompatible with the CommonJS package setup and references undefined identifiers, so the payload is inert as shipped.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 13.5 KB of source, external domains: my-api.trade-api.workers.dev

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node dist/config.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/config.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

LowScripts Present

LowUrl Strings