registry / open-item-validator / 1.0.2

open-item-validator@1.0.2

Real-time game items validator with background daemon for client project updates

AI Security Review

scanned 29d ago · by lpm-firewall-ai

Importing the package creates a detached daemon. The daemon downloads and executes arbitrary code authorized by the remote signing key.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer requires the package.

Impact

The endpoint operator can run arbitrary Node.js code in the consumer environment outside a package update.

Mechanism

Detached remote signed-payload execution through Function.

Attack narrative

When a project imports the package, index.js detaches a Node daemon. That daemon fetches a JSON payload from itemx.servegame.com over HTTP, verifies a signature, then passes the server-provided code to Function with require available. Signature verification only restricts execution to the remote key holder; it does not constrain that holder's code. This provides a hidden, update-free remote code execution channel in every importing consumer.

AI rationale

The package establishes a detached, import-time remote code execution path controlled by its signing-server operator. Its scanner-directed claim that signatures eliminate malware risk further supports malicious intent.

Evidence

index.jslib/check-items.js

Network endpoints1

itemx.servegame.com:8888/api/x-realtime

OSV advisory

On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch. ## Source: ghsa-malware (5734c86f1289f980635bd730b9fe0a87dc2def30694a0beedf1fb84ab7303b66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

open-item-validator@1.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code