registry / Remote code execution / ratelimitsucks
ratelimitsucks
Republished package
This report shows the evidence for ratelimitsucks@2.0.0. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms automatic third-party remote code execution and an obfuscated proxy relay chain. Although npm installation alone has no lifecycle execution, the shipped entrypoint contains a concrete unsafe runtime payload.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
A user opens or hosts the package's `index.html`.
Impact
Remote operators can change browser-executed code and route proxied browser traffic through their infrastructure.
Mechanism
automatic remote script execution plus service-worker-backed proxy relay
Attack narrative
This is not a rate-limiting library. Its HTML entry automatically fetches and executes code from `c.vipersfutbol.com`, then initializes an obfuscated Scramjet/libcurl proxy system with a service worker, WebAssembly module, and WebSocket relay at `21baseballacademy.com`. The package therefore gives remote third parties code-execution control in any browser session that opens its entrypoint and can relay browser traffic through an unrelated endpoint.
AI rationale
Direct source inspection confirms automatic third-party remote code execution and an obfuscated proxy relay chain. Although npm installation alone has no lifecycle execution, the shipped entrypoint contains a concrete unsafe runtime payload.
Evidence
package.jsonindex.htmlassets/boot-CVPGRFHh.jsassets/proxy-runtime-1NyFshf9.jsct1tl/pap3do.jsbfjdx/757lr8.jsbfjdx/w7m632.wasmct1tl/csbzam.js
Network endpoints3
c.vipersfutbol.com/script.jswww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDHwss://21baseballacademy.com/fairs/
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.html` auto-loads remote `https://c.vipersfutbol.com/script.js`.
- `index.html` also executes two local proxy/runtime bundles on page load.
- `assets/boot-CVPGRFHh.js` configures a Scramjet proxy with `wss://21baseballacademy.com/fairs/`.
- `assets/boot-CVPGRFHh.js` registers a service worker and loads `bfjdx/w7m632.wasm`.
- `ct1tl/pap3do.js` injects scripts and hooks proxied fetch, cookies, storage, and WebSocket behavior.
- Core entry bundles are deliberately obfuscated, obscuring the runtime request and proxy logic.
Evidence against
- `package.json` contains no `preinstall`, `install`, `postinstall`, or other lifecycle script.
- No Node filesystem, process, or child-process execution path was found in the inspected package entrypoints.
- The remote/proxy behavior triggers when the packaged HTML application is opened, not merely when npm installs it.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
Source & flagged code
9 flagged · loading sourceassets/proxy-runtime-1NyFshf9.jsView file
1patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L11patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Secret Pattern
AWS access key ID in assets/proxy-runtime-1NyFshf9.js
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1bfjdx/757lr8.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Findings
2 Critical5 High6 Medium4 Low
CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js
CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js
HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js
HighObfuscated
HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa.js
HighKnown Malware Source Fingerprint Signatureassets/ChatPage-zoA8Z6RX.js
MediumDynamic Requirebfjdx/757lr8.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebfjdx/w7m632.wasm
MediumStructural Risk Force Deep Review
Medium
Affected versions and remediation
This report applies to ratelimitsucks@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing ratelimitsucks@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.