registry / ventra-kit / 1.0.2

ventra-kit@1.0.2

A lightweight utility toolkit for JavaScript and Node.js projects, providing common helper functions for everyday development.

AI Security Review

scanned 5d ago · by lpm-firewall-ai

A caller invoking the exported loader causes a request to a hard-coded IP endpoint and executes server-provided JavaScript. The payload is given unrestricted Node process and module-loading capabilities.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Runtime invocation of the package's exported function.

Impact

Remote server can run arbitrary code in the consuming process.

Mechanism

Remote response fetched and executed with Function.

Attack narrative

index.js exports a function that calls getPlugin(). It fetches JSON from a hard-coded IP address, extracts data.credits, constructs a Function from it, and invokes it with require, process, global, Buffer, and timer APIs. This gives the remote endpoint arbitrary code execution in the consumer's Node process.

Rationale

The source implements a direct remotely controlled code-execution path; the lack of an install hook only limits activation to runtime use.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

31.97.137.157:45000/icons/116

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence with false-positive risk.

ventra-kit@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code