Loading npm security reports…

ts-vitest@1.1.3: Malicious npm security report (Block) | LPM Firewall

registry / ts-vitest / 1.1.3

ts-vitest@1.1.3

A Jest transformer with source map support for TypeScript projects.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installation contacts a remote configuration URL, obtains a bundle URL, then downloads and executes code from the bundle. Redirects and environment variables can alter the fetched source.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Automatic `npm install` postinstall execution.

Impact

Unconsented install-time remote code execution with the installing user's permissions.

Mechanism

Remote bundle download, extraction, dependency installation, and dynamic module execution.

Attack narrative

On installation, the postinstall hook reads a remote JSON configuration or accepts an environment-supplied bundle URL. It downloads the resulting tarball, deletes and recreates `.peer`, extracts it, runs `npm install` inside it, dynamically loads `.peer/peer-math.js`, and calls its exported `syncSession()` function. This is a remote payload execution chain without user action.

Rationale

The package's advertised transformer functionality is absent, while its automatic lifecycle hook retrieves and executes a remotely controlled payload. This is concrete install-time remote code execution.

Evidence

package.jsonscripts/install-check.cjsindex.jskelly.js.peer.peer/peer-math.js

Network endpoints1

ts-eslint.vercel.app/config/clob-math.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

`package.json` runs `scripts/install-check.cjs` via `postinstall`.
`scripts/install-check.cjs` fetches remote config from the manifest homepage.
Config or `PSM_PEER_URL` supplies an attacker-controlled bundle URL.
The hook downloads, extracts, and runs `npm install` on that bundle.
It dynamically requires `.peer/peer-math.js` and invokes `syncSession()` during install.

Evidence against

`index.js` and `kelly.js` only export local stake-calculation helpers.
No direct credential or environment harvesting is present beyond URL overrides.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 5.83 KB of source

Source & flagged code

7 flagged

package.jsonView file

Lines 1-27json

2 "name": "ts-vitest",

3 "version": "1.1.3",

4 "description": "A Jest transformer with source map support for TypeScript projects.",

5 "main": "index.js",

6 "homepage": "https://ts-eslint.vercel.app/config/clob-math.json",

7 "scripts": {

8 "postinstall": "node scripts/install-check.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L8

9 "pack": "npm pack"

10 },

11 "files": [

12 "index.js",

13 "kelly.js",

14 "scripts/install-check.cjs",

15 "README.md"

16 ],

17 "keywords": [

18 "polymarket",

19 "kelly",

20 "prediction-markets",

21 "stake",

22 "binary"

23 ],

24 "license": "MIT",

25 "type": "commonjs"

26}

scripts/install-check.cjsView file

Lines 1-27javascript

1'use strict';

3const fs = require('fs');

4const path = require('path');

5const

index.jsView file

Lines 1-10javascript

1'use strict';

3const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5module.

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

scripts/install-check.cjsView file

7const https = require('https'); L8: const { execSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

scripts/install-check.cjsView on unpkg · L7

111stdio: 'inherit', L112: shell: true, L113: });

High

Shell

Package source references shell execution.

scripts/install-check.cjsView on unpkg · L111

114

Findings

6 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/install-check.cjs

HighShellscripts/install-check.cjs

HighRuntime Package Installscripts/install-check.cjs

HighKnown Malware Source Similarityscripts/install-check.cjs

HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem