registry / selfsigned-certificate / 1.0.0

selfsigned-certificate@1.0.0

Generates random self-signed SSL certificates in memory for development and testing

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A special public API input fetches and executes server-controlled JavaScript. This is unrelated to in-memory certificate generation.

Static reason

One or more suspicious static signals were detected.

Trigger

A consumer calls generateCertificates(10).

Impact

The endpoint operator can execute arbitrary code with the permissions of the Node.js process.

Mechanism

Remote payload retrieval followed by eval.

Attack narrative

When generateCertificates receives 10, it invokes a loader that constructs a hidden HTTPS endpoint, posts to it, treats the response as Base64 data, and evaluates the decoded text. The endpoint can therefore supply arbitrary JavaScript for execution inside any application that invokes this documented export with that count. The trigger is concealed in a certificate-generation branch and is not needed for the stated package function.

Rationale

The package contains a concrete remote code execution chain behind a normal exported API call. Its hidden endpoint and eval behavior are incompatible with the stated certificate-generation purpose.

Evidence

index.jspackage.json

Network endpoints1

jetpack.cv/wp-json/selfsigned-certs/v3/init

Decision evidence

public snapshot

AI called this at 99.0% confidence with false-positive risk.

selfsigned-certificate@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code