items-validator

GHSA-hvv9-35pw-8qvf

Malicious code in items-validator (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.5`

## Source: amazon-inspector (a8e49b1abd7c566b17104c5a2823251df2ca253a0fa509d7c19db1c1942ad13d)
On require, index.js invokes initializeDaemon() at top level, which uses spawn('node', [lib/check-items.js], { detached: true, stdio: 'ignore' }) followed by child.unref() to launch a persistent background process independent of the parent. The daemon HTTP-GETs a JSON payload from the hardcoded endpoint https://game.spawnrealm.com/api/item-realtime?key=abcdef123456 and passes payload.code to `new Function('require', 'module', payload.code)`, executing server-supplied JavaScript inside the installer's Node process with full `require` access. An RSA signature check is performed against a public key bundled in the package (crypto-config.js), so the author controls both the signing key and the verifier and the check provides no independent integrity guarantee. Anyone controlling game.spawnrealm.com — including via DNS or TLS — can run arbitrary code as the installing user for the lifetime of the host process. The package is advertised as a validator library, and this remote-code-loader behavior is undisclosed and unrelated to the stated purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/501714751ba269514a0a7215c211de39b4230b65/osv/malicious/npm/items-validator/MAL-2026-17235.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/501714751ba269514a0a7215c211de39b4230b65/osv/malicious/npm/items-validator/MAL-2026-17235.json
- https://www.npmjs.com/package/items-validator/v/1.0.5
- https://github.com/ossf/malicious-packages/blob/770428f773c57daa2de3ac23ad3257d748d27072/osv/malicious/npm/items-validator/MAL-2026-17235.json
- https://www.npmjs.com/package/items-validator/v/1.0.4
- https://github.com/advisories/GHSA-hvv9-35pw-8qvf

Compromised versions (1)

= 1.0.5

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.