velabuild
This report shows the evidence for velabuild@2.2.0. 8 of 9 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-13493 confirms this npm version as malicious.
Advisory
MAL-2026-13493
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in velabuild (npm)
Details
cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to `ssh -o StrictHostKeyChecking=no -i <key> ubuntu@79.72.65.161` to invoke bash scripts under /home/ubuntu/signing-server for the CLI's signup/login/deploy subcommands. The private key is shipped identically to every installer of the package, so anyone who downloads the tarball obtains valid SSH credentials to the author's server. Installing or requiring the package does not read installer-side secrets, does not fetch or execute attacker-controlled code on the installer, and does not modify the installer's filesystem outside the package's own temp key file. A secondary observation: the `rx signup` / `rx login` subcommands pass user-supplied username and password as shell arguments to auth.sh over the shared SSH tunnel, but this only fires when the user explicitly invokes those subcommands and matches the package's documented auth backend.
## Source: ghsa-malware (3c64dbb041d6e5afb6472e08a1c6a3d31b123bdbb00d99bc8452e826848d4666) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The package contains a real, high-risk remote-access capability and handles user passwords/project data through a fixed server, but all such behavior is tied to documented explicit CLI commands. Its postinstall hook is informational only, so the source does not establish malicious install-time behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
User runs rx signup, rx login, rx deploy, download, or createkey.
Impact
User credentials and selected project/certificate material are sent to a remote server; shell command construction and disabled host verification add unresolved security risk.
Mechanism
Embedded SSH credential and shell-based remote build/deployment
AI rationale
The package contains a real, high-risk remote-access capability and handles user passwords/project data through a fixed server, but all such behavior is tied to documented explicit CLI commands. Its postinstall hook is informational only, so the source does not establish malicious install-time behavior.
Evidence
package.jsoncli.js~/.rdfxvela/.session~/.rdfxvela/.ostemporary rdfx-key-* fileproject pages/project common/project sign/project src/
Network endpoints1
79.72.65.161
Independent scan evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- cli.js embeds and decodes an RSA private key.
- cli.js disables SSH host-key verification to 79.72.65.161.
- Explicit signup/login send entered passwords through remote SSH commands.
- Explicit deploy uploads project archives to the hard-coded server.
Evidence against
- package.json postinstall only prints a quick-start message.
- Network, key decoding, and shell actions require explicit rx commands.
- No install-time file mutation, payload execution, harvesting, or agent-control writes found.
- The staged temporary file is an SSH key consumed by ssh, not an executable payload.
Behavioral surface
ChildProcessFilesystem
HighEntropyStringsUrlStrings
Source & flagged code
4 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node -e "console.log('\n🚀 Welcome to VelaBuild!\n\n📝 Quick start:\n rx setup\n rx signup\n rx init\n rx createpage index\n rx deploy\n\n📱 Build Mi Band 9 apps from anywhere!\n...
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node -e "console.log('\n🚀 Welcome to VelaBuild!\n\n📝 Quick start:\n rx setup\n rx signup\n rx init\n rx createpage index\n rx deploy\n\n📱 Build Mi Band 9 apps from anywhere!\n...
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgcli.jsView file
8const os = require('os');
L9: const { execSync } = require('child_process');
L10: const inquirer = require('inquirer');
High
Child Process
Package source references child process execution.
cli.jsFindings
3 High2 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processcli.js
HighEmbedded Payload Drop Executioncli.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to velabuild@2.2.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing velabuild@2.2.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.