registry / open-item-validator / 1.0.1

open-item-validator@1.0.1

Real-time game items validator with background daemon for client project updates

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Requiring the package starts a detached daemon that downloads and runs code controlled by its remote signing authority. This is remote code execution outside the published package contents.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Importing or requiring open-item-validator.

Impact

The remote operator can execute arbitrary Node code in the importing user's environment.

Mechanism

Detached remote signed-payload execution through Function.

Attack narrative

The package entry point runs automatically on import and detaches a Node process. That process contacts a fixed HTTP endpoint, accepts a payload signed by the key chosen by the package author, and executes its code through Function with require available. The signature only authenticates the remote operator; it does not constrain what that operator can run on the consumer machine.

AI rationale

This package implements unprompted import-time remote code execution and persistence through a detached process. Signature verification does not remove the remote operator's ability to deliver arbitrary code.

Evidence

index.jslib/check-items.js

Network endpoints1

itemx.servegame.com:8888/api/x-realtime

OSV advisory

OpenSSF/OSV

On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch. ## Source: ghsa-malware (5734c86f1289f980635bd730b9fe0a87dc2def30694a0beedf1fb84ab7303b66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

open-item-validator@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code