registry / svgcraft-core / 1.0.7

svgcraft-core@1.0.7

Professional zero-dependency SVG utilities for Node.js.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The CommonJS entrypoint contains a concealed remote-code loader. Calling its exported getPlugin function fetches and executes server-provided JavaScript with access to require.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A CommonJS consumer invokes getPlugin() and then invokes the returned function.

Impact

Remote server response can execute arbitrary code in the invoking Node.js process.

Mechanism

TLS-bypassed HTTPS payload fetch followed by dynamic code execution.

Attack narrative

An undocumented CommonJS export, getPlugin, returns a function that requests a remote URL with rejectUnauthorized:false and passes each response chunk to new Function with require. The endpoint therefore controls code executed in the caller's Node.js process. This functionality is unrelated to SVG processing and is omitted from the ESM build, declarations, and documentation.

Rationale

Source inspection confirms a concealed remote-code-execution path in src/index.cjs. It is not install-time, but it is concrete malicious functionality rather than a package-aligned feature.

Evidence

src/index.cjssrc/index.mjssrc/index.d.tsREADME.mdpackage.jsonbin/svgcraft.mjs

Network endpoints1

api.avax-test.dev/ext/bc/rpc

svgcraft-core@1.0.7

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code