registry / Remote code execution / rust-testing-utils
rust-testing-utils
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for rust-testing-utils@2.3.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a concrete remote-code-execution chain activated by normal runtime use. Lack of an npm lifecycle hook limits installation impact but does not mitigate the malicious runtime behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A consumer calls the exported middleware function.
Impact
Arbitrary code execution with the consuming user's privileges; the remote payload can perform follow-on theft, persistence, or destructive actions.
Mechanism
Detached child downloads and dynamically executes remote code.
Attack narrative
When an application invokes the package's exported middleware, index.js launches lib/caller.js as a detached Node process. That file decodes an embedded URL and request header, retrieves a response property, constructs a function from it, and invokes it with require. This is a remote payload execution channel independent of application input and remains active after the caller returns.
AI rationale
The package contains a concrete remote-code-execution chain activated by normal runtime use. Lack of an npm lifecycle hook limits installation impact but does not mitigate the malicious runtime behavior.
Evidence
index.jslib/caller.jspackage.json
Network endpoints1
api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b03a-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The exported middleware spawns a detached Node process for lib/caller.js when invoked.
- lib/caller.js decodes embedded request parameters, downloads a response field, and executes it with require access.
- The remote endpoint is api.jsonstorage.net; returned code runs with the consuming process's privileges.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- No local file harvesting or AI-agent configuration mutation was found in inspected source.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flagged · loading sourcelib/caller.jsView file
2L3: const axios = require("axios");
L4: const process = {
...
L12: (async function loadCallers(..._args) {
L13: const src = atob(process.env.DEV_API_KEY);
L14: const k = atob(process.env.DEV_SECRET_KEY);
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
lib/caller.jsView on unpkg · L22L3: const axios = require("axios");
L4: const process = {
...
L12: (async function loadCallers(..._args) {
L13: const src = atob(process.env.DEV_API_KEY);
L14: const k = atob(process.env.DEV_SECRET_KEY);
High
Base64 Obscured Url
Source decodes a Base64-obscured HTTP endpoint at runtime.
lib/caller.jsView on unpkg · L2•matchType = malicious_source_fingerprint_signature
signature = 306e52008bef5331
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = chai-as-reformed@1.2.0
matchedPath = lib/caller.js
matchedIdentity = npm:Y2hhaS1hcy1yZWZvcm1lZA:1.2.0
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
Findings
1 Critical5 High3 Medium3 Low
CriticalRemote Response Code Executionlib/caller.js
HighEval
HighBase64 Obscured Urllib/caller.js
HighKnown Malware Source Fingerprint Signaturelib/caller.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to rust-testing-utils@2.3.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing rust-testing-utils@2.3.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.