registry / spoint / 0.1.699

spoint@0.1.699

OSV Malicious Advisory

scanned 5d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13725 confirms this npm version as malicious. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Advisory

MAL-2026-13725

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in spoint (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Decision reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

References

OSV advisory ADVISORY

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

Manifest

WildcardDependency

scanned 432 file(s), 4.70 MB of source, external domains: anentrypoint.github.io, gist.github.com, stackoverflow.com, tavianator.com, www.reddit.com, www.shadertoy.com, www.w3.org

Source & flagged code

10 flagged

package.jsonView file

•scripts.postinstall = node scripts/patch-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

server.jsView file

26import { fileURLToPath } from 'node:url' L27: import { execFileSync } from 'node:child_process' L28:

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L26

src/sdk/scaffold.jsView file

27console.log(`[scaffold] created apps/ at ${localApps}`) L28: let result = spawnSync('bunx', ['skills', 'add', 'AnEntrypoint/spawnpoint', '--agent', '*', '--skill', 'spoint', '--yes'], { stdio: 'inherit', shell: true }) L29: if (result.status !== 0) {

High

Shell

Package source references shell execution.

src/sdk/scaffold.jsView on unpkg · L27

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/sdk/scaffold.jsView on unpkg · L27

src/fluid/as-src/sph.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = spoint@0.1.692 matchedIdentity = npm:c3BvaW50:0.1.692 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/fluid/as-src/sph.tsView on unpkg

9const proxyInfo = await response.text(); L10: eval(proxyInfo); L11: } catch (err) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/fluid/as-src/sph.tsView on unpkg · L9

bin/router-boot.jsView file

39console.log(`[router-boot] using world: ${worldName}`) L40: const worldDef = (await import(pathToFileURL(worldPath).href + `?t=${Date.now()}`)).default || {} L41:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/router-boot.jsView on unpkg · L39

src/static/ProgressiveBake.jsView file

53const jsonLen = b.readUInt32LE(12) L54: const json = JSON.parse(b.slice(20, 20 + jsonLen).toString()) L55: const samplers = json.samplers || [] ... L93: const out = Buffer.alloc(total) L94: out.write('glTF', 0); out.writeUInt32LE(2, 4); out.writeUInt32LE(total, 8) L95: out.writeUInt32LE(jb.length, 12); out.writeUInt32LE(0x4E4F534A, 16); jb.copy(out, 20)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/static/ProgressiveBake.jsView on unpkg · L53

bin/ktx.exeView file

•path = bin/ktx.exe kind = native_binary sizeBytes = 2034592 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ktx.exeView on unpkg

client/basis/basis_transcoder.wasmView file

•path = client/basis/basis_transcoder.wasm kind = wasm_module sizeBytes = 527333 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

client/basis/basis_transcoder.wasmView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

server.jsView file

26import { fileURLToPath } from 'node:url' L27: import { execFileSync } from 'node:child_process' L28:

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L26

src/sdk/scaffold.jsView file

High

Findings

1 Critical4 High8 Medium7 Low

CriticalPrevious Version Dangerous Deltasrc/fluid/as-src/sph.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processserver.js

HighShellsrc/sdk/scaffold.js

HighRuntime Package Installsrc/sdk/scaffold.js

MediumDynamic Requirebin/router-boot.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Native Binarybin/ktx.exe

MediumShips Wasm Moduleclient/basis/basis_transcoder.wasm

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present