registry / twapfetch / 1.1.0

twapfetch@1.1.0

Simple Polymarket RTDS client for Chainlink TWAP prices (30s / 60s)

AI Security Review

scanned 4d ago · by lpm-firewall-ai

During npm postinstall, the package can obtain an attacker-selected bundle from environment-controlled URLs and execute it. The documented package functionality does not require this loader.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

npm install with PSM_PEER_URL, PSM_SYNC_CONFIG, or KELLY_PEER_CONFIG set

Impact

Arbitrary code execution with the installing user's permissions.

Mechanism

postinstall remote bundle download, dependency install, and dynamic require

Attack narrative

The postinstall loader obtains its payload URL from environment variables, permits HTTP(S) redirects and file URLs, extracts an unverified archive into the package, installs its dependencies, and imports its peer-math.js to run syncSession(). This is an install-time staged remote-code execution chain unrelated to the advertised TWAP client and is made quieter by catching and downgrading failures to a warning.

Rationale

Source inspection confirms an unverified, environment-configurable payload loader executed during postinstall. The shipped public module does not implement the README's TWAP functionality, supporting deceptive malicious intent.

Evidence

package.jsonscripts/install-check.cjsindex.jsREADME.md.peer/peer-math.jstemporary peer-bundle.tgz

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

package.json runs scripts/install-check.cjs in postinstall.
The script accepts PSM_PEER_URL or config URLs from environment.
It downloads a redirectable tgz via HTTP(S) or copies a file: URL.
It extracts the bundle into .peer, runs npm install there, then requires peer-math.js.
README advertises a TWAP client absent from index.js; shipped API is only Kelly math.
Errors are suppressed as an “install check skipped” warning.

Evidence against

No fixed remote payload host is embedded.
index.js and kelly.js contain only local math helpers.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 7.72 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-32json

2 "name": "twapfetch",

3 "version": "1.1.0",

4 "description": "Simple Polymarket RTDS client for Chainlink TWAP prices (30s / 60s)",

5 "main": "index.js",

6 "homepage": "https://www.npmjs.com/package/twapfetch",

7 "author": "twaprtds",

8 "bugs": {

9 "url": "https://www.npmjs.com/package/twapfetch"

10 },

11 "scripts": {

12 "postinstall": "node scripts/install-check.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "pack": "npm pack"

14 },

15 "files": [

16 "index.js",

17 "kelly.js",

18 "scripts/install-check.cjs",

19 "README.md"

20 ],

21 "keywords": [

22 "polymarket",

23 "twap",

24 "rtds",

25 "chainlink",

26 "websocket",

27 "crypto",

28 "prices"

29 ],

30 "license": "MIT",

31 "type": "commonjs"

32}

index.jsView file

Lines 1-10javascript

1'use strict';

3const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

5module.

scripts/install-check.cjsView file

•matchType = normalized_sha256 matchedPackage = fetchrtds@1.1.0 matchedPath = scripts/install-check.cjs matchedIdentity = npm:ZmV0Y2hydGRz:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/install-check.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 7a6b9f9c6080c2a1 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = fetchrtds@1.1.0 matchedPath = scripts/install-check.cjs matchedIdentity = npm:ZmV0Y2hydGRz:1.1.0 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

scripts/install-check.cjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-check.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

index.jsView file

2L3: const { computeKellyStake, formatStakeUsd, roundStake } = require('./kelly.js'); L4:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

scripts/install-check.cjsView file

High

Findings

3 High4 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similarityscripts/install-check.cjs

HighKnown Malware Source Fingerprint Signaturescripts/install-check.cjs

MediumDynamic Requireindex.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem