satanic-release@2.4.0
Multi-Device
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest launches index.js, whose connection handler performs publisher-selected account actions automatically. This is concrete, unrequested account mutation, so the package should be blocked.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting the package and establishing a WhatsApp connection.
Impact
The authenticated account may be subscribed to publisher-selected channels or added to a publisher-selected group.
Mechanism
The connection handler iterates over hardcoded newsletter identifiers, calls a computed socket operation for them, and invokes an invitation operation on a fixed target without checking for user consent.
Attack narrative
Starting the package activates a WhatsApp connection. On connection, the code automatically processes embedded newsletter targets and an invitation target, changing the connected account without a caller-selected target or consent check.
AI rationale
The manifest launches index.js, whose connection handler performs publisher-selected account actions automatically. This is concrete, unrequested account mutation, so the package should be blocked.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest names index.js as the package entrypoint and defines a start command that runs it.
- After a successful connection, index.js builds a fixed list of newsletter identifiers and calls a computed socket operation for each.
- The same connection handler calls an invitation operation on a fixed target without a caller-selected target or consent check.
- index.js invokes its startup function, activating the connection flow.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedObfuscatedUrlStrings
WildcardDependency
Source & flagged code
16 flagged · loading sourcesatanic.jsView file
28const fs = require('fs');
L29: const axios = require('axios');
L30: const chalk = require("chalk");
...
L40: const fetch = require('node-fetch')
L41: const FormData = require('form-data')
L42: const cheerio = require('cheerio');
...
L44: const primbon = new Primbon()
L45: const { exec, execSync, spawn } = require("child_process");
L46: const sharp = require('sharp');
...
L61: const raw = fs.readFileSync(DB_FILE);
L62: return JSON.parse(raw);
L63: } catch (err) {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
satanic.jsView on unpkg · L2828Trigger-reachable chain: scripts.start -> index.js -> settings.js -> satanic.js
L28: const fs = require('fs');
L29: const axios = require('axios');
L30: const chalk = require("chalk");
...
L40: const fetch = require('node-fetch')
L41: const FormData = require('form-data')
L42: const cheerio = require('cheerio');
...
L44: const primbon = new Primbon()
L45: const { exec, execSync, spawn } = require("child_process");
L46: const sharp = require('sharp');
...
L61: const raw = fs.readFileSync(DB_FILE);
L62: return JSON.parse(raw);
L63: } catch (err) {
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
satanic.jsView on unpkg · L2817817patternName = google_api_key
severity = high
line = 17817
Findings
2 Critical15 High5 Medium4 Low
CriticalCredential Exfiltrationsatanic.js
CriticalTrigger Reachable Dangerous Capabilitysatanic.js
HighHigh Secretsatanic.js
HighChild Processsatanic.js
HighShell
HighEvalplugins/douyinsearch.js
HighCredential Redirect Persistencesatanic.js
HighCommand Output Exfiltrationsatanic.js
HighHidden Inline Dependency Executionsatanic.js
HighObfuscated Payload Loaderlib/cekban.js
HighTrigger Reachable Credential Exfiltrationsatanic.js
HighRuntime Package Installsatanic.js
HighObfuscated
Affected versions and remediation
This report applies to satanic-release@2.4.0.
See all versions of satanic-release for other recorded verdicts.
- Avoid installing satanic-release@2.4.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.