registry / Remote code execution / webpack-patch
webpack-patch
This document describes the management of vulnerabilities for the project and all modules within the organization.
This report shows the evidence for webpack-patch@1.1.8. 4 of 4 known versions are blocked or flagged. The newest version, 1.2.0, is blocked. See all versions.
AI Security Review
scanned 4mo ago · by lpm-firewall-aiStatic source inspection confirms an attacker-controlled remote payload loader and executor reachable at runtime. Lack of install hooks lowers automatic install-time impact, but does not mitigate confirmed malicious RCE behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Calling exported middleware from index.js, or loading lib/transport.js
Impact
Arbitrary code execution with package consumer privileges; payload behavior is controlled by remote endpoint.
Mechanism
detached child process plus remote payload fetch and Function constructor execution
Attack narrative
The main export looks like middleware, but calling it launches a detached Node process running lib/caller.js. That file fetches a remote JSON value from jsonkeeper.com and executes the returned `cookie` string as JavaScript with access to `require`. The same caller module is also imported by lib/transport.js, creating another runtime side-effect path. This is unconsented remote code execution, not package-aligned functionality.
AI rationale
Static source inspection confirms an attacker-controlled remote payload loader and executor reachable at runtime. Lack of install hooks lowers automatic install-time impact, but does not mitigate confirmed malicious RCE behavior.
Evidence
package.jsonindex.jslib/caller.jslib/transport.jslib/tools.js
Network endpoints1
jsonkeeper.com/b/D3GLF
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.js exports middleware that spawns detached `node ./lib/caller.js` when invoked.
- lib/caller.js fetches `https://jsonkeeper.com/b/D3GLF` with axios.
- lib/caller.js reads `.data.cookie` from the response and executes it via `new Function.constructor("require", s)`.
- lib/transport.js imports `./caller`, so loading that module also triggers the remote fetch/execute side effect.
- Package appears to copy Pino files/docs while publishing as `webpack-patch`, with added remote-code loader.
Evidence against
- package.json has no install/preinstall/postinstall lifecycle scripts.
- No local credential/file harvesting code is visible in inspected package source before the remote payload executes.
Behavioral surface
ChildProcessEnvironmentVarsNetwork
HighEntropyStringsUrlStrings
Source & flagged code
1 flagged · loading sourcedocs/transports.mdView file
550patternName = generic_password
severity = medium
line = 550
matchedText = password...rd',
Medium
Findings
1 High3 Medium3 Low
HighEval
MediumNetwork
MediumEnvironment Vars
MediumSecret Patterndocs/transports.md
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to webpack-patch@1.1.8.
The versions list below shows the verdict for each recorded version.
- Avoid installing webpack-patch@1.1.8. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.