registry / Credential exfiltration / soajs.controller
soajs.controller
soajs multi tenant API gateway
This report shows the evidence for soajs.controller@4.3.20. 2 of 9 known versions are blocked or flagged. The newest version, 4.3.21, is allowed. See all versions.
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe source traces a configured Kubernetes token from registry configuration into an authenticated request whose CA branch uses a package-selected hardcoded host. This is a concrete credential disclosure path and warrants blocking.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A runtime registry load uses Kubernetes configuration with a token, URL, and CA settings, then requests node data.
Impact
The token may be disclosed to an unrelated remote host, exposing access to the Kubernetes cluster.
Mechanism
The CA branch builds its Kubernetes client from a hardcoded server and assigns the configured token as bearer authentication when request options contain no auth.
Attack narrative
When registry configuration includes a Kubernetes token, URL, and CA settings, the registry invokes the node lookup. In the CA branch, the driver builds its client using the hardcoded http://server.com host and supplies the configured token as bearer authentication when no auth is already set. The subsequent node API request can therefore disclose the cluster token to that host.
AI rationale
The source traces a configured Kubernetes token from registry configuration into an authenticated request whose CA branch uses a package-selected hardcoded host. This is a concrete credential disclosure path and warrants blocking.
Evidence
modules/registry/mongo.jsmodules/driver/kubernetes/model/index.jsmodules/driver/kubernetes/bl/get.jsmodules/driver/kubernetes/model/node.jsmodules/driver/kubernetes/model/clients/node.js
Network endpoints1
server.com
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Registry loading passes a stored Kubernetes token, URL, and CA configuration into the node lookup path.
- When CA configuration is present, the Kubernetes driver uses a hardcoded server at http://server.com instead of the configured cluster URL.
- If the CA request options have no authentication, the driver sets the stored token as the bearer credential.
- The registry node lookup calls the Kubernetes node API, completing the path that sends requests using the configured authentication.
- The manifest lists a test script, with no install lifecycle hook; the identified exposure is in runtime behavior.
Evidence against
- The exposure requires runtime use of the Kubernetes registry path with CA configuration; the ordinary non-CA branch uses the configured URL.
- The package manifest has no install lifecycle hook.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStrings
Source & flagged code
7 flagged · loading sourcetest/unit/mw/key/index.jsView file
17patternName = generic_password
severity = medium
line = 17
Medium
Secret Pattern
Package contains a possible secret pattern.
test/unit/mw/key/index.jsView on unpkg · L17178patternName = generic_password
severity = medium
line = 178
Medium
Secret Pattern
Hardcoded password in test/unit/mw/key/index.js
test/unit/mw/key/index.jsView on unpkg · L178Gruntfile.jsView file
10L11: const fs = require('fs');
L12: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
Gruntfile.jsView on unpkg · L10Findings
1 High7 Medium5 Low
HighKnown Malware Source Similaritymodules/registry/mongo.js
MediumSecret Patterntest/unit/mw/key/index.js
MediumDynamic RequireGruntfile.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterntest/unit/mw/key/index.js
MediumSecret Patterntest/data/provision/urac/users/second_owner.js
MediumSecret Patterntest/data/provision/urac/users/owner.js
LowScripts Present
LowWeak Cryptomw/cache/index.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to soajs.controller@4.3.20.
The versions list below shows the verdict for each recorded version.
- Avoid installing soajs.controller@4.3.20. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.