registry / Remote code execution / velora-kit
velora-kit
A lightweight and reusable toolkit for modern applications. Velora Kit provides simple utilities and helper functions that make development faster and easier.
This report shows the evidence for velora-kit@12.1.2. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete staged remote-code-execution path, not a benign CDN fetch: server-controlled content is dynamically executed with privileged Node globals. Absence of lifecycle hooks limits automatic installation-time activation but does not remove the malicious runtime backdoor.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Consumer invocation of the default-exported getPlugin function.
Impact
Remote server can run arbitrary code with the invoking application's permissions.
Mechanism
remote payload fetch followed by Function-based execution
Attack narrative
A consumer calling the default export triggers a request to https://31.97.137.157:45000/icons/116. The package parses the JSON response and supplies data.credits directly as the body of a Function constructor. It immediately invokes that function with require, process, globalThis, Buffer, and path context, so the endpoint operator can execute arbitrary Node.js actions under the consumer process's permissions.
AI rationale
This is a concrete staged remote-code-execution path, not a benign CDN fetch: server-controlled content is dynamically executed with privileged Node globals. Absence of lifecycle hooks limits automatic installation-time activation but does not remove the malicious runtime backdoor.
Evidence
index.jspackage.json
Network endpoints1
31.97.137.157:45000/icons/116
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Default export fetches code from a hard-coded IP endpoint.
- Remote response field data.credits is passed to Function and executed.
- Executed remote code receives require, process, global, Buffer, and filesystem-path context.
Evidence against
- No npm preinstall, install, or postinstall lifecycle hook is declared.
- Network execution requires a consumer to invoke the default export; import alone does not call it.
Behavioral surface
EvalNetwork
Source & flagged code
7 flagged · loading sourceindex.jsView file
6L7: // Create require that resolves from the project root (where package.json and node_modules are)
L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
...
L90:
L91: return fetch(url, { headers: head })
L92: .then(response => {
...
L95: }
L96: return response.json();
L97: });
...
L133: exports: {},
L134: __dirname: process.cwd(),
L135: __filename: import.meta.url,
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L6149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
•matchType = malicious_source_fingerprint_signature
signature = c06bd55d669269cb
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = copytrade-core@2.3.0
matchedPath = index.js
matchedIdentity = npm:Y29weXRyYWRlLWNvcmU:2.3.0
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Findings
1 Critical6 High2 Medium1 Low
CriticalRemote Response Code Executionindex.js
HighEvalindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to velora-kit@12.1.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing velora-kit@12.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.