exam-kit @1.0.3

Summary

On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypts it using a hardcoded key ('bf497c0b9cee'), and pipes the plaintext into a detached node child process via stdin (spawn('node', [], {detached:true, stdio:['pipe','ignore','ignore']}); stdin.write(rsaDecrypted); unref()). The decrypted bytes are opaque code executed on the installer's host with no integrity check. The loader hides its purpose with cover-story naming: a variable named rsaDecrypted actually holds DES-decrypted content, the function readLogoIco treats an.ico asset as ciphertext, and errors are logged as 'ThetaSDK initialization error' — unrelated to the package's stated exam-session purpose. The path-traversal source (../../../../public/logo.ico), hardcoded symmetric key, misleading log strings, and detached/unref'd spawn are dropper-loader characteristics rather than legitimate library behavior.

Source: amazon-inspector (29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313)