registry / Remote code execution / vexium-kit
vexium-kit
A lightweight utility toolkit for JavaScript and Node.js projects, providing common helper functions for everyday development.
This report shows the evidence for vexium-kit@2.0.2, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete remote-code-execution loader, inconsistent with the documented utility package. Lack of an install hook limits automatic activation but does not remove the malicious runtime behavior.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Application code calls the default export from vexium-kit.
Impact
Arbitrary code execution with the permissions of the consuming Node process.
Mechanism
Remote response execution through Function constructor.
Attack narrative
At runtime, the exported function calls getPlugin(), which fetches JSON from a hard-coded external IP. It treats data.credits as JavaScript and executes it with require, process, globalThis, Buffer, and timer APIs supplied as arguments. The endpoint can therefore deliver arbitrary Node.js payloads to every consumer that invokes the export.
AI rationale
This is a concrete remote-code-execution loader, inconsistent with the documented utility package. Lack of an install hook limits automatic activation but does not remove the malicious runtime behavior.
Evidence
package.jsonindex.jsREADME.md
Network endpoints1
31.97.137.157:45000/icons/116
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js fetches https://31.97.137.157:45000/icons/116.
- index.js passes response JSON data.credits to new Function.
- The remote code receives require, process, global, Buffer, and timers.
- Exported function invokes the remote loader when called.
- README claims utilities/zero dependencies, but source implements a remote code loader.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- Remote request is not made merely by importing the module.
Behavioral surface
EvalNetwork
Source & flagged code
3 flagged · loading sourceindex.jsView file
6L7: // Create require that resolves from the project root (where package.json and node_modules are)
L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
...
L90:
L91: return fetch(url, { headers: head })
L92: .then(response => {
...
L95: }
L96: return response.json();
L97: });
...
L133: exports: {},
L134: __dirname: process.cwd(),
L135: __filename: import.meta.url,
Critical
Remote Response Code Execution
Source passes code obtained from a remote response into a dynamic execution sink.
index.jsView on unpkg · L6149// Note: The code uses async/await, so we need to handle that
L150: const evalFn = new Function(
L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',
High
•matchType = malicious_source_fingerprint_signature
signature = 34c9b829bcd3b8e8
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = ventra-kit@1.0.2
matchedPath = index.js
matchedIdentity = npm:dmVudHJhLWtpdA:1.0.2
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
index.jsView on unpkgFindings
1 Critical2 High2 Medium1 Low
CriticalRemote Response Code Executionindex.js
HighEvalindex.js
HighKnown Malware Source Fingerprint Signatureindex.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to vexium-kit@2.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing vexium-kit@2.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.