취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (23293f1bc28e465f7ffaf916fd8a6cc3958b873a2b338b81c0bf71bb146d1d36)

package.json declares a postinstall script that runs node src/install.js after building a local binary. src/install.js is a 175 KB single-line payload obfuscated with a Function(...) constructor wrapper, LZString-compressed UTF-16 string tables, and per-helper rotated base85 alphabets. Once de-obfuscated, the payload resolves the strings child_process, node-fetch/fetch, -c, shell, detached, stdio, ignore, performs an outbound fetch(url, {headers:...}), reads the response body, and passes it to require('child_process').spawn('sh', ['-c', <fetched-body>], {shell, detached, stdio:'ignore'}). This fires unattended on npm install and runs attacker-controlled shell content with the installer's privileges. The multi-layer obfuscation (Function-constructor + LZString + rotated alphabets + global rebinding through aliased getters such as FTecFy['G9V6x7'] === require) exists solely to hide the fetch-and-exec from scanners and reviewers; legitimate install tooling does not need that. The shipped bin/flare binary built by make is a local CTF-style reverse-engineering challenge (ptrace anti-debug, hardcoded magic constants, XOR-decoded flag string) and is not the installer-harm vector — the dropper in src/install.js is. The CTF framing in the README does not neutralize the install-time RCE: any developer running npm install ctf-flare executes whatever shell text the remote endpoint serves at that moment.

Source: ossf-package-analysis (1e0cd8fbb0f9460f4c76a5479edc1354e5cd16fcee1929e83a3c1122ebbd1513)

The OpenSSF Package Analysis project identified 'ctf-flare' @ 1.0.0 (npm) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.