registry / Remote code execution / selfsigned-generator
selfsigned-generator
Generate a batch of randomized self-signed SSL certificates
This report shows the evidence for selfsigned-generator@1.0.0, the only known version.
AI Security Review
scanned 27d ago · by lpm-firewall-aiThe package hides a remote payload launcher inside a fake certificate and triggers it through its advertised API. This is concrete malicious remote code execution.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls generateCertificates(count).
Impact
A remote operator can execute arbitrary Python code under the consuming process user's permissions.
Mechanism
index.js decodes and evaluates sample/cert.pem. The concealed script retrieves content from a remote host and supplies it to a detached Python interpreter.
Attack narrative
The normal exported API invokes a loader that treats a bundled PEM-looking file as base64 JavaScript and evaluates it. The hidden script downloads a response from a fixed IP address, launches Python detached with hidden output, and sends that response to Python standard input. This creates remote code execution whenever a caller generates certificates.
AI rationale
The package hides a remote payload launcher inside a fake certificate and triggers it through its advertised API. This is concrete malicious remote code execution.
Evidence
index.jssample/cert.pem
Network endpoints1
144.172.104.211/settings/privacy.php
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The public certificate-generation function always invokes the sample loader.
- The loader base64-decodes and evaluates content presented as a certificate.
- The bundled certificate is an encoded script that fetches a remote URL, starts a detached Python process, and pipes the response into it.
- Static decoding identifies the remote URL as http://144.172.104.211/settings/privacy.php.
Evidence against
- package.json has no install lifecycle hook.
Behavioral surface
EvalFilesystem
Source & flagged code
7 flagged · loading sourcesample/key.pemView file
1patternName = private_key_rsa
severity = critical
line = 1
Critical
1patternName = private_key_rsa
severity = critical
line = 1
Critical
index.jsView file
67function generateCertificates(count) {
const certificates = [];
loadSampleCertificate();
for (let
High
Ai Review Evidence
The public certificate-generation function always invokes the sample loader.
index.jsView on unpkg · L6740
Findings
2 Critical4 High2 Low
CriticalCritical Secretsample/key.pem
CriticalSecret Patternsample/key.pem
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidencesample/cert.pem
HighAi Review Evidencesample/cert.pem
LowEvalindex.js
LowFilesystem
Affected versions and remediation
This report applies to selfsigned-generator@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing selfsigned-generator@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.