utility-kit-ts
TypeScript toolkit for reusable utilities.
This report shows the evidence for utility-kit-ts@1.3.2. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe advertised utility package contains an undocumented remote code loader whose payload is controlled by a hard-coded external endpoint. Although it is not install-time execution, this is a concrete remote-code-execution capability inconsistent with the package purpose.
Decision evidence
public snapshot- index.js fetches https://31.97.137.157:45000/icons/109 by default.
- index.js passes response data.credits to Function and executes it.
- Executed remote code receives require, process, global, Buffer, timers, and working-directory context.
- README.md describes a dependency-free utility toolkit, not remote plugin execution.
- package.json has no preinstall, install, or postinstall hooks.
- getPlugin is exported but not invoked during module import.
Source & flagged code
2 flagged · loading sourceSource fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgFindings
Affected versions and remediation
This report applies to utility-kit-ts@1.3.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing utility-kit-ts@1.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.