registry / tsrml612 / 1.13.0

tsrml612@1.13.0

Tiny TypeScript library for structured logging and health checks.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At runtime, the default logger silently decrypts an embedded MongoDB URI and sends queued log records to it. This network destination is concealed by obfuscation and is used when callers omit transport configuration.

Static reason

One or more suspicious static signals were detected.

Trigger

Calling createLogger() without transport, endpoint, or uri; queued records flush by batch size, timer, flush, or close.

Impact

Application log data, including explicitly requested environment-variable values, can be exfiltrated to an undisclosed remote database.

Mechanism

Hidden default MongoDB log export

Attack narrative

Importing alone does not connect, but createLogger() selects Mongo transport by default. Its URI is concealed as encrypted word data and decrypted at runtime, then MongoClient connects and insertMany uploads batched log records. Callers are led by the README toward a local console logger while the shipped artifact defaults to a hidden remote datastore. checkEnv can add selected process.env values to those records.

Rationale

The concealed default remote sink and automatic upload of user application logs form a concrete, undisclosed exfiltration path. Lack of install hooks does not mitigate this runtime behavior.

Evidence

dist/index.jsdist/mongo.d.tsdist/types.d.tspackage.json

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence with false-positive risk.

tsrml612@1.13.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code