registry / ts-utility-plus / 1.3.2

ts-utility-plus@1.3.2

TypeScript toolkit for reusable utilities.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

The default export fetches attacker-controlled code from a hard-coded external IP and executes it. This is runtime remote code execution when the exported function is called.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer imports the package and calls its default getPlugin export.

Impact

Remote operator can run arbitrary Node.js code with the consumer process privileges.

Mechanism

Fetch remote JSON then execute data.credits via Function.

Attack narrative

At runtime, getPlugin requests a hard-coded IP endpoint and parses its JSON response. It constructs a Function from data.credits and invokes it with require, process, global, Buffer, and timers, allowing the server to supply arbitrary Node.js code in the caller's environment. No lifecycle hook is needed; calling the advertised default export triggers the chain.

Rationale

The package contains a concrete remote-payload execution chain, not merely a dynamic-evaluation primitive. Although it is user-invoked rather than install-time, the hard-coded external loader has no integrity or trust boundary.

Evidence

package.jsonindex.js

Network endpoints1

31.97.137.157:45000/icons/109

OSV Corroboration

OpenSSF/OSV

The package's default export `getPlugin` performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and passes the response field `data.credits` into `new Function('require','module',...)` with `require`, `process`, `Buffer`, and other Node globals injected as arguments, then invokes the constructed function. This gives the operator of that IP arbitrary code execution inside the installer's Node process whenever the package is required and its default export is called. A cover-story of Font Awesome / icon CDN naming (`IconProvider`, `iconDomain`, `/ajax/libs/font-awesome/...`, `bearrtoken:"logo"`) surrounds the real payload URL, which is assembled by concatenating `protocol`+`separator`+`domain`+`path` where `domain` is the bare IP. The declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with a follow-on credential/browser-secret stealer delivered through this channel.

ts-utility-plus@1.3.2

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code