ventrix-kit
This report shows the evidence for ventrix-kit@0.5.2. 2 of 4 known versions are blocked or flagged. The newest version, 0.0.0-stage, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 3mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-12494 confirms this npm version as malicious.
Advisory
MAL-2026-12494
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in ventrix-kit (npm)
Details
ventrix-kit@1.5.2 ships a loader that, when the package's default `getPlugin` export is invoked, performs an HTTP request to the hardcoded endpoint http://31.97.137.157:45000/icons/116 and passes the response's `credits` field to the JavaScript `Function` constructor, executing the returned code with `require`, `module`, `exports`, `process`, `Buffer`, and other Node globals in scope. The destination is a bare IP on a non-standard port with no pinning, signing, or integrity verification; the executed content is fully attacker-controlled and mutable server-side. The package's metadata and identifiers frame the loader as a CDN icon fetcher (`iconDomain`, `path = "/icons/"`, a `bearrtoken: "logo"` header, a `font-awesome`-shaped path, and an unused `setDefaultModule` referencing cdnjs/cloudflare/fastly), and the README advertises the package as a lightweight zero-dependency helper while `dependencies` include axios, express, better-sqlite3, @primno/dpapi, node-machine-id, and socket.io-client — a native-Windows-credential (DPAPI) plus persistent-socket stack inconsistent with an icon helper. Any code path that reaches `getPlugin` grants remote code execution on the consumer's host to the operator of 31.97.137.157.
References
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
1 High
HighOsv Malicious Advisory
Affected versions and remediation
This report applies to ventrix-kit@0.5.2.
The same advisory and Firewall decision cover 2 recorded versions
0.5.2, 1.5.2
The versions list below shows the verdict for each recorded version.
- Avoid installing ventrix-kit@0.5.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.