registry / Remote code execution / type-async
type-async
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for type-async@3.3.7, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concrete remote payload fetch-and-execute chain, independent of scanner labels. The lack of install hooks does not mitigate runtime arbitrary code execution in a package consumer.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application calls the exported middleware from `index.js`.
Impact
Remote operator can run arbitrary Node.js code with the consuming application's permissions.
Mechanism
Detached child process retrieves and dynamically executes remote code.
Attack narrative
At runtime, `index.js` starts detached `node lib/caller.js` whenever its exported middleware is called. `lib/caller.js` requests a fixed URL, extracts `data.cookie`, compiles it with the `Function` constructor, and invokes it with `require`, giving remotely supplied code local module-loading capability. This is an explicit remote-code-execution loader disguised within an unrelated logger-derived package structure.
AI rationale
Source inspection confirms a concrete remote payload fetch-and-execute chain, independent of scanner labels. The lack of install hooks does not mitigate runtime arbitrary code execution in a package consumer.
Evidence
package.jsonindex.jslib/caller.js
Network endpoints1
json.extendsclass.com/bin/250fca079abb
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` spawns detached `node` when middleware is invoked.
- `lib/caller.js` fetches a remote response from `https://json.extendsclass.com/bin/250fca079abb`.
- `lib/caller.js` passes response field `cookie` to `Function` and executes it with `require`.
- `lib/caller.js` retries remote payload execution up to five times and suppresses errors.
- `package.json` has no lifecycle scripts; remote execution occurs at package runtime.
Evidence against
- No package lifecycle hook is declared in `package.json`.
- No concrete credential harvesting, filesystem writes, or AI-agent configuration mutation appears in inspected JavaScript.
- The remote execution path is activated through the exported middleware, not module import alone.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourceindex.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 2ad508fc9ea2882e
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = type-elint@3.3.7
matchedPath = index.js
matchedIdentity = npm:dHlwZS1lbGludA:3.3.7
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgdocs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
2 High3 Medium3 Low
HighEval
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to type-async@3.3.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing type-async@3.3.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.