registry / open-item-validator / 1.0.5

open-item-validator@1.0.5

Real-time game items validator with background daemon for client project updates

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Importing the module creates a detached daemon that downloads and executes code selected by the package operator. A signature gate does not constrain what the signing server may run.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A consumer requires the package.

Impact

The remote server can run arbitrary Node.js code in the consumer environment when the module is imported.

Mechanism

Detached remote payload download followed by Function execution.

Attack narrative

When a consumer imports the main entry point, it spawns a detached Node daemon. The daemon requests a payload from the package-controlled endpoint, checks a signature whose trusted public key is bundled by the package, then passes the returned text to Function with require access. The package operator, or anyone controlling its signing key and server, can therefore deliver arbitrary code without a package update. Documentation also attempts to frame this remote execution mechanism as scanner-compliant and risk-free.

AI rationale

This is concrete remote code execution on import from a hard-coded package-controlled endpoint. Signature verification authenticates the operator's payload but does not make arbitrary remotely delivered Node code safe.

Evidence

index.jslib/check-items.jsSECURITY_SETUP.md

Network endpoints1

game.spawnrealm.com/api/item-realtime?key=abc123def456

OSV advisory

On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch. ## Source: ghsa-malware (5734c86f1289f980635bd730b9fe0a87dc2def30694a0beedf1fb84ab7303b66) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

open-item-validator@1.0.5

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code