Loading npm security reports…

ts-vitest@1.1.1: Malicious npm security report (Block) | LPM Firewall

registry / ts-vitest / 1.1.1

ts-vitest@1.1.1

A Jest transformer with source map support for TypeScript projects.

AI Security Review

scanned 15m ago · by lpm-firewall-ai

Installing the package triggers a remote payload chain. A fetched configuration chooses an archive that is extracted, dependency-installed, dynamically required, and executed.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Arbitrary code can execute in the installing user's environment from an attacker-controlled remote bundle.

Mechanism

remote bundle download, install, dynamic require, and execution

Attack narrative

On npm postinstall, the package fetches a config URL from its manifest unless overridden by environment variables. That config supplies a bundle URL; the script downloads the archive, extracts it to `.peer`, runs `npm install` there, dynamically loads `.peer/peer-math.js`, and calls `syncSession()`. This is an unconsented remote code-execution chain during installation.

Rationale

The package's benign exported helpers do not justify a postinstall flow that retrieves and executes mutable remote code. This is concrete install-time remote code execution.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.jsREADME.md.peer/tmp/psm-sync-*

Network endpoints1

ts-eslint.vercel.app/config/clob-math.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `postinstall`.
`scripts/install-check.cjs` fetches a remote config from the homepage.
The config selects a remotely hosted `.tgz` bundle.
The script extracts the bundle into `.peer` and runs `npm install`.
It dynamically requires `.peer/peer-math.js` and invokes `syncSession()` during install.
Redirects and environment URLs can replace the payload source.

Evidence against

`index.js` and `kelly.js` contain only local Kelly-stake helpers.
No credential harvesting or exfiltration appears in the published local files.
The README and package description do not match the installed runtime behavior.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 5.83 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-27json

2 "name": "ts-vitest",

3 "version": "1.1.1",

4 "description": "A Jest transformer with source map support for TypeScript projects.",

5 "main": "index.js",

6 "homepage": "https://ts-eslint.vercel.app/config/clob-math.json",

7 "scripts": {

8 "postinstall": "node scripts/install-check.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "pack": "npm pack"

10 },

11 "files": [

12 "index.js",

13 "kelly.js",

14 "scripts/install-check.cjs",

15 "README.md"

16 ],

17 "keywords": [

18 "polymarket",

19 "kelly",

20 "prediction-markets",

21 "stake",

22 "binary"

23 ],

24 "license": "MIT",

25 "type": "commonjs"

26}

scripts/install-check.cjsView file

Lines 1-27javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

index.jsView file

Lines 1-10javascript

1'use strict';

3const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5module.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-check.cjsView file

7const https = require('https'); L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/install-check.cjsView on unpkg · L7

111stdio: 'inherit', L112: shell: true, L113: });

High

Shell

Package source references shell execution.

scripts/install-check.cjsView on unpkg · L111

114

Findings

6 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/install-check.cjs

HighShellscripts/install-check.cjs

HighRuntime Package Installscripts/install-check.cjs

HighKnown Malware Source Similarityscripts/install-check.cjs

HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem