Search: module.exports

@ppa-web-components/ppa-banner is a malicious npm package designed as a dependency-confusion trap. It contains a postinstall script and module code that sends system information such as hostname, install path, and working directory in cleartext HTTP to an external IP address. The package exports a no-op Proxy to avoid breaking builds but acts as a beacon to identify internal build environments that mistakenly resolve this public package name. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.

@drone-js-ext/vip-badge is a malicious npm package designed for dependency confusion attacks. It impersonates an internal package scope and contains no legitimate functionality. Upon installation and module load, it sends identifying information about the host machine and environment to a hardcoded external IP address over unencrypted HTTP. This behavior exposes sensitive host details to an uncontrolled third party. The package exports a Proxy that returns no-op functions to hide its lack of functionality. The package is considered fully compromising to any system where it is installed.

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.

Admidio versions from 5.0.0 up to but not including 5.0.16 contain an authorization bypass vulnerability. This flaw allows authenticated users with list view rights to export member lists as PDF files despite export restrictions. The issue arises because the groups_roles_export check in the relevant PHP module omits the 'pdfl' mode, which is used for PDF exports.

The nitro-cjs-requirer npm package contains malicious code that acts as a beacon to send host and environment information to a hardcoded IP address over plain HTTP. It executes this data transmission both during installation and when the module is required, without user consent or documentation. The module itself exports a proxy that returns no-op functions, making it appear benign while performing reconnaissance on the host system.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec) Package presents itself as n8n helper nodes but ships an empty stub `index.js` (`module.exports = {}`) and no functional node modules. On `npm install`, `postinstall.js` runs automatically: it performs an HTTPS GET to `https://mkicom.com/.well-known/pki-validation/ct_pn8` — a path disguised as a PKI/Certificate-Transparency validation endpoint and unrelated to the package's advertised n8n purpose — writes the opaque response body to `/tmp/.np`, chmods it 0755, and executes it via `spawn('/bin/sh', ['-c', 'setsid /tmp/.np... &'], {detached: true})` so the process survives npm exit. There is no hash, signature, or version pinning on the downloaded bytes. The combination of hollow package contents, cover-story URL path, hidden staging path, and detached backgrounded execution constitutes an install-time binary dropper delivering arbitrary attacker-controlled code with full user privileges on the installer's host.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f49ee5bcbcb7e8f1028de4021134fdbbc895e737700cf82a834fb26d3b23dd05) postinstall.js fetches an opaque binary from https://mkicom.com/.well-known/pki-validation/ct_dn8, writes it to /tmp/.nc, chmods it 0755, and launches it detached via `spawn('/bin/sh', ['-c', 'setsid ' + OUT + '... &'], {detached:true})`. The download URL is disguised under a `.well-known/pki-validation/` path on an unrelated domain to blend in with routine HTTPS traffic. index.js is an empty stub (`module.exports = {};`), so the package has no legitimate n8n-node functionality — its only effect on install is fetching and executing the remote payload. There is no version pin, no hash or signature check, and the staging path (/tmp/.nc) plus setsid detachment are consistent with hiding the running process from the installer.

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and the library's constructor executes native code in the host process before engine-symbol validation rejects it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process, worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code execution. Fixed in 3.11.7.

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in packages/mocker/src/node/interceptorPlugin.ts register the vitest:interceptor:register handler on Vite's unauthenticated HMR WebSocket without validating redirect targets against the file-serving allowlist. The implementation processes event.redirect without enforcing server.fs.allow and server.fs.deny through isFileLoadingAllowed. A remote client that can reach an exposed development server can submit an opaque URL scheme preserving .. segments, causing join(server.config.root, redirectUrl.pathname) to resolve outside the project root. The plugin's load hook then returns readFile(mock.redirect, 'utf-8') as module source, disclosing local files readable by the dev-server process. Vitest browser mode uses a token-authenticated RPC and is not remotely unauthenticated by default, although the same boundary check was missing on that path. This issue is fixed in versions 4.1.11 and 5.0.0-rc.2.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4) The package advertises itself as text helpers for AI pipelines (toText/normalizeText) but src/index.js unconditionally invokes a dropper at module top level on require()/import. The dropper downloads a platform-specific installer from https://anymeetvia.com/download/{win|mac-x86_64|linux}/install1[.ps1] into the OS temp directory, chmods it 0755 on macOS/Linux, and executes it via powershell -File on Windows or bash on Unix, then calls process.exit. There is no version pinning, no hash or signature verification, and the download endpoint is an author-controlled domain unrelated to the advertised functionality. The remote installer content is not present in the package and can be changed by whoever controls anymeetvia.com at any time. The README and module.exports document only the text-helper API; the dropper is undocumented. ## Source: ghsa-malware (157801df9aca5cfc352c39f3fae51f04dd16ee810064ea6d95d4cd99f98931ff) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba) depcruise-fmt ships an empty module (index.js exports {}) and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz rather than a registry package. On npm install, npm fetches and installs that off-registry tarball into the dependency tree and executes any lifecycle scripts it contains. The wrapper package has no other functionality — its sole effect is to inject the externally hosted payload. The tarball is served from an author-controlled Google Cloud Storage bucket, is not subject to registry publish scanning, is not integrity-pinned, and its contents can be replaced at any time without a corresponding npm publish. The package name also resembles the popular dependency-cruiser tooling, positioning this as a lookalike lure whose only installation effect is to resolve to the GCS-hosted tarball. ## Source: ossf-package-analysis (ea193e6cea73a06c8f92a684d56040564d6a0fef93da1d45010978107ea0fd0c) The OpenSSF Package Analysis project identified 'depcruise-fmt' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

The npm package 'chai-as-promised-plus' version 6.1.3 is a typosquatting malicious package that mimics the legitimate 'chai-as-promised' assertion helper. It contains a large obfuscated JavaScript payload that replaces the module exports at load time, executing attacker-controlled code within the consumer's Node.js process. This behavior is characteristic of supply-chain attacks where malicious code is delivered to users who install the package.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020) blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogger`/`getCurrentStatus` from `dist/src/handlelogs.mjs`) that POSTs any string passed to it to `https://api.telegram.org/bot<token>/sendMessage` with a hardcoded `chat_id` of `-1003846719897`. Three live Telegram bot tokens are embedded in the compiled bundle and rotated round-robin; the destination chat is not caller-configurable and is not disclosed in the README. Alongside the relay, the same file exposes `getEnhancedDeviceInfo` (re-exported as `getDeviceInfo`), which gathers precise GPS latitude/longitude with a `https://www.google.com/maps?q=<lat>,<lng>` link, unique device id, IP address, VPN state, brand/model/OS, battery, storage, timezone, locale, and security posture (rooted, emulator, screenLock, mockLocation), and can be stringified via `stringifyData` and passed straight into `consoleApp` to be shipped to the same Telegram chat. Any application that integrates blekit and calls the exported logger silently transmits its data — and, when the device-info helper is used, end-user GPS coordinates and persistent device identifiers — to an author-controlled Telegram channel that the app developer and end user never opted into. ## Source: ghsa-malware (f4213a76b2c5c574d5bfa41897a698d068ba56f146c88855eb2aeb2aac8ec9eb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1) dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing eval(atob('<~32KB obfuscator.io payload>')) that executes on every require()/import of the package. The decoded payload pulls in http, https, zlib and child_process.spawn (with require('child_proc'+'ess') split-string obfuscation and an obfuscator.io string-array dispatcher) and contains hardcoded Ethereum JSON-RPC method names (eth_getBlockByNumber, eth_blockNumber), etherscan-style transaction listing paths (?module=account&action=...&startblock=0&endblock=99999999), a process.env.ETH_RPC_URL read, and hardcoded RPC/explorer hosts under drpc.org, publicnode.com, blockscout.com and blast-api.io. A CSS utility plugin has no legitimate need for network I/O, spawned child processes, or dynamic evaluation of an obfuscated blob. The package name inverts the word order of the established tailwind-scrollbar-hide plugin, consistent with a typosquat carrier for the loader. ## Source: ghsa-malware (db8f8e9574e99a7ff90f6934b87642ac2408d46e35bd267f6281d3e8061071db) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (554372f29af60ad8e6e5a33171a736baddcc652772b0452c81a4010d3f1e5218) index.js is a top-level self-decoding IIFE that XOR-decodes a URI-encoded payload keyed on the enclosing function's own source and eval()s the result at module load; the decoder aborts with 'the code has been tampered!' if the source is modified, and a banner asks readers not to crack it. The decoded payload is opaque and cannot be audited without executing it. The package's own metadata and typings describe the runtime behavior: package.json advertises it as a 'client (provider) for the tsi-vpsremote control server' that 'stays alive to run commands pushed from the server', keywords include 'shell', 'ssh', 'remote-control', and 'agent', and index.d.ts exports a ProviderHandle exposing a ChildProcess named `shell`. Calling the exported provider(url) at runtime therefore establishes a persistent connection to a remote server that drives a local ChildProcess on the host running the package — a network-to-shell control channel with full-host command execution for whoever controls the paired server URL. ## Source: ghsa-malware (3437dfe049006b09ad2f66c94d934907ac32e7272a22ad75694179e136ac90a8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d) index.js exports getPlugin() which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the response field data.credits to new Function('require','module',...,data.credits), executing attacker-controlled JavaScript with require, process, and Buffer injected. The request is framed with cover-story naming (a font-awesome/CDN path fragment and a 'bearrtoken: logo' header) that is unrelated to the actual bare-IP destination and inconsistent with the package's stated 'crypto checkout' purpose. Declared dependencies (@primno/dpapi for Windows DPAPI unwrap, node-machine-id, better-sqlite3) are consistent with a credential/wallet-stealer payload delivered through the loader. ## Source: ghsa-malware (36320c265cebe6479c4c4d438a043d4c38fb14b9e02bd8f97130c557b19a2b2c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (bfc85c0238f90672b0cc329cae3487061924ed5a6458644a97cd90a830ace807) index.js exports a getPlugin function that issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/<n> and passes the response's `credits` field to `new Function('require','module',...,data.credits)`, invoking the returned function with a live `require`, `process`, and `Buffer` in scope. Any consumer that loads the package's default export executes attacker-supplied JavaScript with full Node privileges on the host. The C2 URL is assembled from split literals (protocol/separator/domain/path) alongside a decoy setDefaultModule that constructs cdnjs font-awesome URLs, disguising the traffic as icon-CDN requests, and the authorization header is spelled `bearrtoken` to further avoid casual inspection. Declared dependencies (@primno/dpapi for Windows DPAPI unwrap, better-sqlite3, node-machine-id) are consistent with follow-on wallet and browser-secret harvesting delivered by the remote payload. ## Source: ghsa-malware (d5d588d45a7677764b972a1892308e61160b2803021af65ba25b1d47534fa264) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f) build/index.js appends an eval(atob('...')) block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints (eth.blockscout.com, 1rpc.io/eth, eth.drpc.org, blastapi.io) for transactions from a hardcoded attacker wallet (0xa322E5f3D311D3080e6f01210639aDC2490Ef1a), reconstructs an IPv4 address from the bytes of tx.to, then fetches http://<resolved-ip>:443/0x/cls and http://<resolved-ip>:443/0x/ls. The response body is XOR-decoded with a hardcoded key and executed via eval() and a detached spawn('node','-e',...) child process (detached:true, stdio:'ignore', windowsHide:true, unref()). The C2 endpoint is mutable — the attacker rotates it by publishing new on-chain transactions from the controlled wallet — giving persistent remote code execution on any machine that imports the library. All require targets, URLs, HTTP header/method names, and error strings in the appended region are written as \u00XX unicode escapes and wrapped in base64+atob+eval; the legitimate __exportStar re-exports above the appended block are plain text, so the sole obfuscated region is the loader. ## Source: ghsa-malware (cd595e257df7f4732d6451f4cb0203806490fb7226f8815b0c583cf860d3b3ce) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47) build/index.js appends an eval(atob(...)) blob to the legitimate common-library exports, so the payload runs whenever any consumer require()s @rentwise/common. The decoded payload queries public Ethereum JSON-RPC nodes and eth.blockscout.com/api to fetch the latest transaction sent by the hardcoded wallet 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a, reconstructs an IPv4 address from the transaction's tx.to field (bytes 0-3 as octets), then HTTP GETs http://<ip>:443/0x/cls and http://<ip>:443/0x/ls. The response body is XOR-decoded using the x-payload-b64 header, eval()'d in-process, and additionally spawned as a detached `node -e <payload>` child process with stdio:ignore and windowsHide. All strings (module names http/https/zlib/child_process, URLs, RPC method names) are \uXXXX-escaped inside the base64 blob to defeat static string matching. The blockchain-anchored C2 (EtherHiding pattern) lets the operator rotate infrastructure by broadcasting a new on-chain transaction. This grants arbitrary remote code execution on any host that installs and loads the package. ## Source: ghsa-malware (0bbef705c23f606ecd8e4257d3de3818a1e460136c9c3aa8a5aafa1b93c0585b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The npm package 'gamified-trading-system' contains malicious code that acts as a remote loader, fetching and executing arbitrary code from an attacker-controlled endpoint. It masquerades as a trading gamification library but exports only functions that load and execute remote payloads with full Node.js module privileges. The package also includes dependencies and artifacts consistent with credential theft and machine fingerprinting, and ships with an embedded private SSH key, indicating hostile provenance. Installation of this package results in full compromise of the host system.