open-item-validator

Details

**Severity:** Critical

**Affected versions:** `= 1.0.3`

## Source: amazon-inspector (7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457)
On require(), index.js spawns a detached, unref'd background Node process (lib/check-items.js) that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the returned JavaScript via new Function('require','module', payload.code)(require, moduleObj). The daemon survives the parent process and re-polls the endpoint on a configured interval, so whoever controls that endpoint runs arbitrary Node code on the installer's host on library load and continuously thereafter. The fetch is over plain HTTP to a No-IP dynamic-DNS host (servegame.com) that does not match the publisher's declared homepage (game.spawnrealm.com); a bundled RSA signature check does not alter that the endpoint operator chooses what code runs. README framing as 'signed game code updates' is inconsistent with the shipped generic fetch-and-exec mechanism and the publisher/destination host mismatch.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/2f2a8b510bbb9a3eb30ebbdd572c609e6e461af3/osv/malicious/npm/open-item-validator/MAL-2026-16052.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/2f2a8b510bbb9a3eb30ebbdd572c609e6e461af3/osv/malicious/npm/open-item-validator/MAL-2026-16052.json
- https://www.npmjs.com/package/open-item-validator/v/1.0.3
- https://www.npmjs.com/package/open-item-validator/v/1.0.5
- https://github.com/ossf/malicious-packages/blob/13e8595c79aa77f55791b60aeedd2f0a87857edc/osv/malicious/npm/open-item-validator/MAL-2026-16052.json
- https://www.npmjs.com/package/open-item-validator/v/1.0.0
- https://www.npmjs.com/package/open-item-validator/v/1.0.1
- https://www.npmjs.com/package/open-item-validator/v/1.0.2
- https://www.npmjs.com/package/open-item-validator/v/1.0.4

Compromised versions (1)

• = 1.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.