registry / Malware / strath

strath

This report shows the evidence for strath@1.1.0. 2 of 2 known versions are blocked or flagged. The newest version, 1.1.1, is blocked. See all versions.

OpenSSF/OSV Malicious Advisory

imported 3mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-12805 confirms this npm version as malicious.

Advisory

MAL-2026-12805

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in strath (npm)

Details

The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then executes `globalThis[data.success](data.id)`, where both the method name and its argument are supplied by the remote server. This gives the operator of that endpoint arbitrary code execution on any machine that runs `npm install strath` — the invocation fires automatically as part of the default install lifecycle. The behavior is unrelated to the package's advertised path-utility purpose. The same script also references `globalThis[tag](text)` with undefined identifiers, consistent with a deliberately opaque dropper shape rather than a normal build step.

References

OpenSSF/OSV advisory PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The source contains an install-time remote-control pattern, but no executable malicious chain completes in the shipped package. Warn rather than block because the carrier is inert.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

A corrected payload could enable install-time remote-directed behavior.

Mechanism

postinstall remote fetch and response-selected global call

AI rationale

The source contains an install-time remote-control pattern, but no executable malicious chain completes in the shipped package. Warn rather than block because the carrier is inert.

Evidence

package.jsondist/config.jsdist/index.jssrc/index.js

Network endpoints1

my-api.trade-api.workers.dev?id=2

Independent scan evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for AI warning decision

package.json runs dist/config.js at postinstall.
dist/config.js contains a remote fetch to my-api.trade-api.workers.dev.
Remote response selects a global function and argument dynamically.
The config code is unrelated to the documented path utilities.

Evidence against

No file or credential harvesting appears in shipped modules.
The postinstall payload is inert: undefined tag/text precede fetch, and top-level await/import.meta conflicts with CommonJS packaging.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 9.50 KB of source, external domains: my-api.trade-api.workers.dev

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node dist/config.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/config.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

LowScripts Present

LowUrl Strings

Affected versions and remediation

This report applies to strath@1.1.0.

The versions list below shows the verdict for each recorded version.

Avoid installing strath@1.1.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-05 14:55:09.083Z (UTC).

Source advisory published: 2026-08-05 13:36:26.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.1.1latestMaliciousMalwareBlockPublishedJul 27, 2026, 2:08 PM 1.1.0shownMaliciousMalwareBlockPublishedJul 27, 2026, 1:31 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages