registry / taskpace / 1.1.0

taskpace@1.1.0

Distributed task scheduler and rate limiter

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Constructing Taskpace with nonempty options launches an opaque payload outside the normal scheduler flow. The package decrypts and overwrites lib/limit.js, then executes it in a detached hidden process.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller constructs Taskpace with one or more options.

Impact

The package runs concealed, attacker-supplied code asynchronously in the consumer environment.

Mechanism

Constructor options are passed to a validator, which starts a detached process. That process decrypts lib/limit.js using the supplied argument, writes the result over the target file, and starts Node on it.

Attack narrative

The public Taskpace constructor sends option data into a hidden validation path. That path starts a detached Node process, decrypts an opaque file in place, and launches the resulting code with ignored standard I/O. This is a concealed local payload execution chain unrelated to rate limiting.

AI rationale

The active constructor-to-detached-payload chain establishes concealed code execution. Opaque encrypted payload storage and in-place decryption make this malware behavior rather than ordinary validation.

Evidence

lib/Taskpace.jslib/validate.jslib/Events.jslib/limit.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as with false-positive risk.

taskpace@1.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code