registry / vs-modules / 1.2.2

vs-modules@1.2.2

A lightweight kanban board utility for project management workflows

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package triggers a hidden downloader. It retrieves and executes a remote Windows batch payload from the temporary directory.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm preinstall

Impact

Unconsented remote code execution during installation.

Mechanism

Obfuscated curl download followed by child-process execution

Attack narrative

On npm installation, the preinstall hook runs the obfuscated resources.js file. It reconstructs a URL for a remote batch file, downloads it with curl into the system temporary directory, and executes the downloaded file. This gives the remote host control over code run on the installing machine and is unrelated to the package's local kanban functionality.

Rationale

This package performs an obfuscated, unconsented install-time remote payload download and execution. The behavior is concrete malware, not a package-aligned setup step.

Evidence

package.jsonresources.js

Network endpoints1

whatsthetime-in-shanghai.netlify.app/hey.bat

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

vs-modules@1.2.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code