registry / twapfetch / 1.1.1

twapfetch@1.1.1

Simple Polymarket RTDS client for Chainlink TWAP prices (30s / 60s)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

npm installation fetches attacker-controlled remote configuration and bundle content, installs it, then executes a module from that bundle. This is a concrete staged remote-code-execution chain.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm postinstall

Impact

Arbitrary code from a remotely selected package can run with the installing user's permissions.

Mechanism

remote bundle download, npm install, and dynamic module execution

Attack narrative

During postinstall, the package downloads JSON from its homepage (or an environment-selected URL), obtains a bundle URL, downloads and extracts the tgz to .peer, runs npm install there, and requires .peer/peer-math.js before calling syncSession. The remote operator can replace the configuration or bundle to execute arbitrary code during installation.

Rationale

The shipped API does not need this installer, while its postinstall executes a remotely controlled dependency payload. This is concrete install-time remote code execution.

Evidence

package.jsonscripts/install-check.cjsindex.jsREADME.md.peer<temporary>/psm-sync-*/peer-bundle.tgz.peer/peer-math.js

Network endpoints1

slimopump.vercel.app/config/clob-math.json

twapfetch@1.1.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code