registry / Remote code execution / tsihealth-client
tsihealth-client
Tools for the server to check system health and monitor performance, along with antivirus software to manage the environment.
This report shows the evidence for tsihealth-client@1.0.4. 5 of 6 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiAlthough activation is user-invoked rather than install-time, the package conceals a remote shell behind a health-client interface. The concrete command-and-control behavior warrants blocking.
Static reason
No blocking static signals were detected.
Trigger
Application imports the package and calls provider(serverUrl).
Impact
A supplied or compromised control server can execute arbitrary OS commands with the host process's privileges.
Mechanism
Obfuscated WebSocket-controlled shell execution.
Attack narrative
The exported provider function activates an obfuscated virtual-machine payload. Its embedded strings and control flow show registration to the supplied server, WebSocket command handling, platform shell spawning (cmd.exe or /bin/bash), and output/acknowledgement relay. This creates a remote-command channel not justified by the advertised health-monitoring API.
AI rationale
Although activation is user-invoked rather than install-time, the package conceals a remote shell behind a health-client interface. The concrete command-and-control behavior warrants blocking.
Evidence
package.jsonindex.jsREADME.mdindex.d.ts
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js is heavily obfuscated and begins with anti-inspection text.
- index.js imports child_process.spawn and embeds cmd.exe and /bin/bash shell strings.
- Decoded embedded program logic handles WebSocket "command" messages and command acknowledgements.
- provider(serverUrl) connects to a caller-supplied server, registers host data, and can relay spawned-shell output.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- README.md documents an explicit provider(serverUrl) invocation.
- No hard-coded network host or package-file write primitive was found.
Behavioral surface
DynamicRequire
HighEntropyStringsMinifiedTrivial
Source & flagged code
1 flagged · loading sourceindex.jsView file
1// Please do not crack or read this; respect the author of this library.
L2: import{spawn}from'node:child_process';import vmn from'node:os';import vmR from'ws';let vmK=typeof globalThis!=='undefined'?globalThis:typeof window!=='undefined'?window:global,vmt_...
Medium
Findings
2 Medium2 Low
MediumDynamic Requireindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to tsihealth-client@1.0.4.
The versions list below shows the verdict for each recorded version.
- Avoid installing tsihealth-client@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.