registry / Remote code execution / type-context
type-context
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for type-context@3.2.7. 4 of 4 known versions are blocked or flagged. The newest version, 3.2.11, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe source contains an active remote JavaScript loader, not merely suspicious dependencies or unused primitives. Absence of install hooks does not mitigate runtime remote code execution.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application imports the package and invokes the exported middleware factory.
Impact
Remote operator can execute arbitrary code in the consuming application's user context.
Mechanism
Detached remote payload fetch followed by dynamic Node code execution.
Attack narrative
Calling the exported middleware runs `runJobA`, which detaches `node lib/caller.js`. The child repeatedly requests a remote endpoint, takes `data.cookie` from the response, and compiles it through the Function constructor with `require` supplied. This is a concrete remote code-execution loader; the payload is controlled by the remote endpoint and runs without the application's informed consent.
AI rationale
The source contains an active remote JavaScript loader, not merely suspicious dependencies or unused primitives. Absence of install hooks does not mitigate runtime remote code execution.
Evidence
package.jsonindex.jslib/caller.js
Network endpoints1
json.extendsclass.com/bin/250fca079abb
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.js` spawns detached `node lib/caller.js` when middleware is invoked.
- `lib/caller.js` fetches `https://json.extendsclass.com/bin/250fca079abb` with axios.
- `lib/caller.js` reads remote `data.cookie` as JavaScript source.
- `lib/caller.js` executes that source using `new Function.constructor("require", s)`.
- Detached child uses ignored stdio and `unref()`, reducing visibility.
Evidence against
- `package.json` contains no npm preinstall/install/postinstall lifecycle hook.
- No credential or local-file harvesting is present in the inspected malicious path.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourceindex.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 2ad508fc9ea2882e
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = type-async@3.3.7
matchedPath = index.js
matchedIdentity = npm:dHlwZS1hc3luYw:3.3.7
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgdocs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
2 High3 Medium3 Low
HighEval
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to type-context@3.2.7.
The versions list below shows the verdict for each recorded version.
- Avoid installing type-context@3.2.7. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.