registry / Remote code execution / ts-vitest
ts-vitest
A Jest transformer with source map support for TypeScript projects.
This report shows the evidence for ts-vitest@1.1.3. 7 of 8 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package's advertised transformer functionality is absent, while its automatic lifecycle hook retrieves and executes a remotely controlled payload. This is concrete install-time remote code execution.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Automatic `npm install` postinstall execution.
Impact
Unconsented install-time remote code execution with the installing user's permissions.
Mechanism
Remote bundle download, extraction, dependency installation, and dynamic module execution.
Attack narrative
On installation, the postinstall hook reads a remote JSON configuration or accepts an environment-supplied bundle URL. It downloads the resulting tarball, deletes and recreates `.peer`, extracts it, runs `npm install` inside it, dynamically loads `.peer/peer-math.js`, and calls its exported `syncSession()` function. This is a remote payload execution chain without user action.
AI rationale
The package's advertised transformer functionality is absent, while its automatic lifecycle hook retrieves and executes a remotely controlled payload. This is concrete install-time remote code execution.
Evidence
package.jsonscripts/install-check.cjsindex.jskelly.js.peer.peer/peer-math.js
Network endpoints1
ts-eslint.vercel.app/config/clob-math.json
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `package.json` runs `scripts/install-check.cjs` via `postinstall`.
- `scripts/install-check.cjs` fetches remote config from the manifest homepage.
- Config or `PSM_PEER_URL` supplies an attacker-controlled bundle URL.
- The hook downloads, extracts, and runs `npm install` on that bundle.
- It dynamically requires `.peer/peer-math.js` and invokes `syncSession()` during install.
Evidence against
- `index.js` and `kelly.js` only export local stake-calculation helpers.
- No direct credential or environment harvesting is present beyond URL overrides.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-check.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgscripts/install-check.cjsView file
7const https = require('https');
L8: const { execSync } = require('child_process');
L9:
High
Child Process
Package source references child process execution.
scripts/install-check.cjsView on unpkg · L7111stdio: 'inherit',
L112: shell: true,
L113: });
High
114
Findings
6 High4 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/install-check.cjs
HighShellscripts/install-check.cjs
HighRuntime Package Installscripts/install-check.cjs
HighKnown Malware Source Similarityscripts/install-check.cjs
HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs
MediumDynamic Requireindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to ts-vitest@1.1.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing ts-vitest@1.1.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.