registry / open-item-validator / 1.0.4

open-item-validator@1.0.4

Real-time game items validator with background daemon for client project updates

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Importing this package launches a detached daemon that downloads and executes code chosen by the remote signing-key holder. The signature check does not constrain what that authorized server may execute.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Requiring the package at runtime.

Impact

The remote server can run arbitrary Node.js code in the importing application's environment.

Mechanism

Detached remote signed-payload download followed by dynamic execution.

Attack narrative

When an application imports the package, index.js spawns a detached Node process. That process downloads a code string from game.spawnrealm.com and, after verifying a signature controlled by the package publisher's server, executes it through Function with access to require. This gives the remote signing-key holder a post-publication path to run arbitrary code in each importing application's environment without publishing a new package version.

AI rationale

This is concrete remote code execution activated by a normal import, not merely a validator. The signing gate authenticates the publisher-controlled remote payload but does not make its arbitrary execution safe.

Evidence

index.jslib/check-items.jsSECURITY_SETUP.md

Network endpoints1

game.spawnrealm.com/api/item-realtime?key=abc123def456

OSV advisory

On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch. ## Source: ghsa-malware (5734c86f1289f980635bd730b9fe0a87dc2def30694a0beedf1fb84ab7303b66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

open-item-validator@1.0.4

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code