registry / xxcf2026 / 1.2.1

xxcf2026@1.2.1

雪雪交易机器人 · SnowRich MT5 Trading Bot (Windows 一键安装)

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Installing the package on Windows automatically retrieves or stages a PE installer and launches it. The downloaded payload is mutable and not integrity-checked.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of the package on Windows

Impact

Unconsented execution of an opaque native installer during dependency installation.

Mechanism

install hook downloads or stages and detached-launches an executable

Attack narrative

The install lifecycle invokes the CLI with the install command. On Windows, that command downloads an executable from a redirectable latest-release URL or copies the bundled PE into the temporary directory, then launches it detached. There is no checksum or signature validation in the JavaScript path, so package installation executes an opaque and mutable native payload without an explicit user command.

AI rationale

This is a concrete install-hook abuse chain: automatic lifecycle execution fetches or stages a native payload and launches it without integrity verification. The absence of direct credential theft in the wrapper does not neutralize the unconsented opaque payload execution.

Evidence

package.jsonbin/xxcf.jsinstaller/SnowRichSetup.exe%TEMP%/SnowRichSetup.exe

Network endpoints1

github.com/xxcf2026/xxcf2026/releases/latest/download/SnowRichSetup.exe

xxcf2026@1.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code