registry / rust-testing-utils / 2.3.0

rust-testing-utils@2.3.0

This document describes the management of vulnerabilities for the project and all modules within the organization.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Runtime use of the exported middleware launches a detached child that fetches and executes attacker-controlled remote JavaScript. There is no install-time hook, but ordinary package use triggers the chain.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer calls the exported middleware function.

Impact

Arbitrary code execution with the consuming user's privileges; the remote payload can perform follow-on theft, persistence, or destructive actions.

Mechanism

Detached child downloads and dynamically executes remote code.

Attack narrative

When an application invokes the package's exported middleware, index.js launches lib/caller.js as a detached Node process. That file decodes an embedded URL and request header, retrieves a response property, constructs a function from it, and invokes it with require. This is a remote payload execution channel independent of application input and remains active after the caller returns.

Rationale

The package contains a concrete remote-code-execution chain activated by normal runtime use. Lack of an npm lifecycle hook limits installation impact but does not mitigate the malicious runtime behavior.

Evidence

index.jslib/caller.jspackage.json

Network endpoints1

api.jsonstorage.net/v1/json/2ef8c758-a96f-459e-b03a-b3b90379a165/f89e8264-86c2-4684-94da-c3f82d59370f

rust-testing-utils@2.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code