registry / Credential exfiltration / soajs.controller / 4.3.20

soajs.controller@4.3.20

soajs multi tenant API gateway

AI Security Review

scanned 3d ago · by lpm-firewall-ai

The source traces a configured Kubernetes token from registry configuration into an authenticated request whose CA branch uses a package-selected hardcoded host. This is a concrete credential disclosure path and warrants blocking.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A runtime registry load uses Kubernetes configuration with a token, URL, and CA settings, then requests node data.

Impact

The token may be disclosed to an unrelated remote host, exposing access to the Kubernetes cluster.

Mechanism

The CA branch builds its Kubernetes client from a hardcoded server and assigns the configured token as bearer authentication when request options contain no auth.

Attack narrative

When registry configuration includes a Kubernetes token, URL, and CA settings, the registry invokes the node lookup. In the CA branch, the driver builds its client using the hardcoded http://server.com host and supplies the configured token as bearer authentication when no auth is already set. The subsequent node API request can therefore disclose the cluster token to that host.

AI rationale

Evidence

modules/registry/mongo.jsmodules/driver/kubernetes/model/index.jsmodules/driver/kubernetes/bl/get.jsmodules/driver/kubernetes/model/node.jsmodules/driver/kubernetes/model/clients/node.js

Network endpoints1

server.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Registry loading passes a stored Kubernetes token, URL, and CA configuration into the node lookup path.
When CA configuration is present, the Kubernetes driver uses a hardcoded server at http://server.com instead of the configured cluster URL.
If the CA request options have no authentication, the driver sets the stored token as the bearer credential.
The registry node lookup calls the Kubernetes node API, completing the path that sends requests using the configured authentication.
The manifest lists a test script, with no install lifecycle hook; the identified exposure is in runtime behavior.

Evidence against

The exposure requires runtime use of the Kubernetes registry path with CA configuration; the ordinary non-CA branch uses the configured URL.
The package manifest has no install lifecycle hook.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

Source & flagged code

7 flagged

test/unit/mw/key/index.jsView file

Lines 1-37javascript

1"use strict";

3const helper = require("../../../helper.js");

4const mw = helper.requireModule('./mw/key/index');

6describe("Unit test for: mw - key", function () {

7 let req = {

8 "get": () => {

9 return null;

10 },

11 "soajs": {

12 "controller": {"serviceParams": {}},

13 "registry": {

14 "serviceConfig": {

15 "key": {

16 algorithm: "aes256",

17 password: "soajs key lal massa"

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

18 }

19 }

20 },

21 "log": {

22 "error": (err) => {

23 console.log(err);

24 }

25 }

26 }

27 };

28 let res = {};

29 let key = "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9";

30 let keyObj = {

31 "key": "a139786a6e6d18e48b4987e83789430b",

32 "extKey": "3d90163cf9d6b3076ad26aa5ed58556348069258e5c6c941ee0f18448b570ad1c5c790e2d2a1989680c55f4904e2005ff5f8e71606e4aa641e67882f4210ebbc5460ff305dcb36e6ec2a2299cf0448ef60b9e38f41950ec251c1cf41f05f3ce9",

33 "tenant": {"id": "10d2cb5fc04ce51e06000001", "code": "DBTN", "locked": true},

34 "application": {

35 "product": "DSBRD",

36 "package": "DSBRD_GUEST",

37 "appId": "5c0e74ba9acc3c5a84a5125a",

Lines 158-198javascript

158 "users": {

159 "AVAPP_EXMPL": "AVAPP_ALTRN"

160 }

161 }

162 }

163 }

164 }

165 }

166 };

167

168

Gruntfile.jsView file

Lines 1-30javascript

1'use strict';

3/**

4 * @license

6 *

7 * Use of this source code is governed by an Apache license that can be

8 * found in the LICENSE file at the root of this repository

9 */

11const fs

mw/cache/index.jsView file

Lines 104-144javascript

104

105 const serviceConfig = cacheConfig.services && cacheConfig.services[serviceName];

106 if (!serviceConfig || !serviceConfig.enabled) {

107 return next();

modules/registry/mongo.jsView file

•matchType = normalized_sha256 matchedPackage = soajs.controller@4.3.18 matchedPath = modules/registry/mongo.js matchedIdentity = npm:c29hanMuY29udHJvbGxlcg:4.3.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

modules/registry/mongo.jsView on unpkg

test/data/provision/urac/users/second_owner.jsView file

Lines 1-26javascript

1'use strict';

2let user = {

3 _id: "5c8d0c505653de3985aa2001",

4 locked: true,

5 username: "second_owner",

6 password: "$2a$12$geJJfv33wkYIXEAlDkeeuOgiQ6y6MjP/YxbqLdHdDSK7LDG.7n7Pq",

test/data/provision/urac/users/owner.jsView file

Lines 1-26javascript

1'use strict';

2let user = {

3 _id: "5c8d0c505653de3985aa0ffd",

4 locked: true,

5 username: "owner",

6 password: "$2a$12$geJJfv33wkYIXEAlDkeeuOgiQ6y6MjP/YxbqLdHdDSK7LDG.7n7Pq",

Medium

Source & flagged code

7 flagged · loading source

test/unit/mw/key/index.jsView file

17patternName = generic_password severity = medium line = 17

Medium

Secret Pattern

Package contains a possible secret pattern.

test/unit/mw/key/index.jsView on unpkg · L17

178patternName = generic_password severity = medium line = 178

Medium

Secret Pattern

Hardcoded password in test/unit/mw/key/index.js

test/unit/mw/key/index.jsView on unpkg · L178

Gruntfile.jsView file

10L11: const fs = require('fs'); L12: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

Gruntfile.jsView on unpkg · L10

Findings

1 High7 Medium5 Low

HighKnown Malware Source Similaritymodules/registry/mongo.js

MediumSecret Patterntest/unit/mw/key/index.js

MediumDynamic RequireGruntfile.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterntest/unit/mw/key/index.js

MediumSecret Patterntest/data/provision/urac/users/second_owner.js

MediumSecret Patterntest/data/provision/urac/users/owner.js

LowScripts Present

LowWeak Cryptomw/cache/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to soajs.controller@4.3.20.

See all versions of soajs.controller for other recorded verdicts.

Avoid installing soajs.controller@4.3.20. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-19 22:44:50.098Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other credential exfiltration packages

Behavioral surface

Source & flagged code

Related packages

Other credential exfiltration packages