registry / Remote code execution / wallet-analytics

wallet-analytics

TypeScript SDK for token analytics and wallet monitoring.

This report shows the evidence for wallet-analytics@1.4.8. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The code implements a remote, server-controlled payload loader with full Node process access. Lack of automatic import or install execution limits triggering but does not remove the concrete malicious capability.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer calls the default-exported getPlugin function.

Impact

A server operator can run arbitrary code in the consuming process.

Mechanism

Fetches data.credits and executes it via Function with require and process.

Attack narrative

At runtime, a caller of the default export causes index.js to fetch JSON from a hard-coded external IP. The package supplies data.credits from that response as the body of a Function constructor, then invokes it with require, process, globalThis, Buffer, and runtime path values. The endpoint can therefore deliver arbitrary Node code after publication without changing the package.

AI rationale

Evidence

index.jspackage.json

Network endpoints1

46.183.25.232:45000/icons/109

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.js fetches https://46.183.25.232:45000/icons/109.
getPlugin passes response data.credits to new Function.
The remote code receives require, process, global, Buffer, and filesystem-relevant paths.
Remote payload execution is exposed by the package's default export.

Evidence against

package.json has no install lifecycle hooks.
index.js does not invoke getPlugin on import.

Behavioral surface

Source

EvalNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 5.94 KB of source

Source & flagged code

2 flagged

index.jsView file

149// Note: The code uses async/await, so we need to handle that L150: const evalFn = new Function( L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

•matchType = malicious_source_fingerprint_signature signature = c06bd55d669269cb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = alpha-helper@1.3.4 matchedPath = index.js matchedIdentity = npm:YWxwaGEtaGVscGVy:1.3.4 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Source & flagged code

2 flagged · loading source

index.jsView file

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

Findings

2 High1 Medium1 Low

HighEvalindex.js

HighKnown Malware Source Fingerprint Signatureindex.js

MediumNetwork

LowScripts Present

Affected versions and remediation

This report applies to wallet-analytics@1.4.8.

The versions list below shows the verdict for each recorded version.

Avoid installing wallet-analytics@1.4.8. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-06 01:21:44.927Z (UTC).

Source advisory published: 2026-08-05 12:53:28.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 5, 2026, 1:19 PM 1.4.8shownMaliciousRemote Code ExecutionBlockPublishedJul 22, 2026, 2:36 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages