registry / strath / 1.1.0

strath@1.1.0

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Install-time code contains an inert remote-controlled invocation chain unrelated to package functionality. It cannot complete as shipped but is a staged payload carrier.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation

Impact

A corrected payload could enable install-time remote-directed behavior.

Mechanism

postinstall remote fetch and response-selected global call

Rationale

The source contains an install-time remote-control pattern, but no executable malicious chain completes in the shipped package. Warn rather than block because the carrier is inert.

Evidence

package.jsondist/config.jsdist/index.jssrc/index.js

Network endpoints1

my-api.trade-api.workers.dev?id=2

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-12805

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in strath (npm)

Details

The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then executes `globalThis[data.success](data.id)`, where both the method name and its argument are supplied by the remote server. This gives the operator of that endpoint arbitrary code execution on any machine that runs `npm install strath` — the invocation fires automatically as part of the default install lifecycle. The behavior is unrelated to the package's advertised path-utility purpose. The same script also references `globalThis[tag](text)` with undefined identifiers, consistent with a deliberately opaque dropper shape rather than a normal build step.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

package.json runs dist/config.js at postinstall.
dist/config.js contains a remote fetch to my-api.trade-api.workers.dev.
Remote response selects a global function and argument dynamically.
The config code is unrelated to the documented path utilities.

Evidence against

No file or credential harvesting appears in shipped modules.
The postinstall payload is inert: undefined tag/text precede fetch, and top-level await/import.meta conflicts with CommonJS packaging.

Behavioral surface

Source

Network

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 9.50 KB of source, external domains: my-api.trade-api.workers.dev

Source & flagged code

1 flagged

package.jsonView file

•scripts.postinstall = node dist/config.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/config.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 High1 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumNetwork

LowScripts Present

LowUrl Strings