Loading npm security reports…

ts-vitest: Malicious npm security report (Block) | LPM Firewall

registry / ts-vitest / 1.1.1

ts-vitest@1.1.1

A Jest transformer with source map support for TypeScript projects.

AI Security Review

scanned 16m ago · by lpm-firewall-ai

Npm installation triggers a remote-configured payload chain. The lifecycle script downloads, installs, dynamically loads, and executes code not shipped in the package.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

`npm install ts-vitest@1.1.1`

Impact

Arbitrary code can execute with the installing user's permissions.

Mechanism

postinstall remote bundle download, dependency installation, and dynamic module execution

Attack narrative

On installation, the postinstall script resolves a bundle URL from environment variables or the package homepage, fetches a remote configuration and archive, extracts it into the package's `.peer` directory, executes `npm install` there, then dynamically requires and calls remote `peer-math.js`. This creates an unconsented install-time remote-code-execution chain, with unrestricted redirects and URL overrides.

Rationale

The shipped runtime exports harmless local math helpers, but its postinstall fetches and executes an externally controlled payload. This is concrete malicious install-time behavior, not a package-aligned setup step.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.jsREADME.md.peer.peer/peer-math.js

Network endpoints1

ts-eslint.vercel.app/config/clob-math.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `scripts/install-check.cjs` via `postinstall`.
`scripts/install-check.cjs` fetches remote config from the manifest homepage or attacker-controlled env URL.
It downloads a remote `.tgz`, extracts it into `.peer`, then runs `npm install`.
It dynamically requires `.peer/peer-math.js` and invokes its exported `syncSession()` during install.
Redirects are followed without host allowlisting; `PSM_PEER_URL` and config variables can override the source.

Evidence against

`index.js` and `kelly.js` contain only local Kelly-stake calculation helpers.
No benign dependency or transformer implementation explains the install-time remote bundle execution.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 5.83 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-27json

2 "name": "ts-vitest",

3 "version": "1.1.1",

4 "description": "A Jest transformer with source map support for TypeScript projects.",

5 "main": "index.js",

6 "homepage": "https://ts-eslint.vercel.app/config/clob-math.json",

7 "scripts": {

8 "postinstall": "node scripts/install-check.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "pack": "npm pack"

10 },

11 "files": [

12 "index.js",

13 "kelly.js",

14 "scripts/install-check.cjs",

15 "README.md"

16 ],

17 "keywords": [

18 "polymarket",

19 "kelly",

20 "prediction-markets",

21 "stake",

22 "binary"

23 ],

24 "license": "MIT",

25 "type": "commonjs"

26}

scripts/install-check.cjsView file

Lines 1-27javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

index.jsView file

Lines 1-10javascript

1'use strict';

3const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5module.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-check.cjsView file

7const https = require('https'); L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/install-check.cjsView on unpkg · L7

111stdio: 'inherit', L112: shell: true, L113: });

High

Shell

Package source references shell execution.

scripts/install-check.cjsView on unpkg · L111

114

Findings

6 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/install-check.cjs

HighShellscripts/install-check.cjs

HighRuntime Package Installscripts/install-check.cjs

HighKnown Malware Source Similarityscripts/install-check.cjs

HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem