registry / xcryption / 1.0.1

xcryption@1.0.1

Code obfuscation utilities for Node.js

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Installing the package triggers a hidden download-and-execution chain on non-CI, non-production systems. On Windows it extracts and launches a remote executable detached from the installer.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation runs the postinstall lifecycle hook.

Impact

Remote code can execute with the installing user's permissions.

Mechanism

Environment-gated remote payload download, extraction, and detached executable launch.

Attack narrative

The postinstall hook invokes scripts/install.js automatically. The script avoids CI and production environments, downloads a ZIP from Dropbox or an environment-supplied URL, writes it to a randomized temporary location, and extracts it through PowerShell or unzip. It then finds an executable or shell-script payload; on Windows it starts the executable detached and hidden. This is an opaque remote payload execution chain unrelated to the advertised text utility exports.

Rationale

This package contains an automatic, environment-gated remote payload downloader and Windows executable launcher. Its install-time behavior is unrelated to its declared utility functionality and enables unconsented code execution.

Evidence

package.jsonscripts/install.jsos.tmpdir()/.<timestamp>.tmpos.tmpdir()/.data<random>

Network endpoints1

www.dropbox.com

OSV Corroboration

The package declares a postinstall script (scripts/install.js) that on npm install downloads a ZIP archive from https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip, writes it to a randomized dot-prefixed temp directory, extracts it (powershell Expand-Archive on Windows, unzip elsewhere), waits 30 seconds, and executes any.exe/.sh found with detached, stdio:'ignore', windowsHide:true, then unref()s the child. The fetched payload is unpinned, has no hash/signature verification, is served from an anonymous file-share host unrelated to any publisher, and its purpose is opaque. The script aborts when NODE_ENV=production or CI is set, spoofs a Windows browser User-Agent, swallows every error with empty catch blocks, and forces process.exitCode=0 so install always reports success. Package identity is inconsistent: package.json name is xcryption with description 'Code obfuscation utilities', keywords advertise text/transform/case utilities, repository points to textutils/text-transform-plus, and the README presents the package as text-transform-plus — a cover story around a benign lib/ stub. Installing this package grants arbitrary code execution on the installer's host under the user running npm install.

xcryption@1.0.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code