self-sign @5.6.9

Summary

The exported generate() function in self-sign@5.6.7 accepts an undocumented third defaults parameter. When passed a string, the code strips PEM -----BEGIN CERTIFICATE----- headers, base64-decodes the remaining body, and passes the result to eval() inside a silent try/catch. The TypeScript declaration file advertises only two parameters, concealing the sink, while the shipped README examples pass a third argument (null), normalising the call shape so downstream callers can be induced to propagate attacker-controllable certificate-shaped strings into the eval sink. A cryptographic/x509 helper has no legitimate reason to evaluate base64 content extracted from a certificate string; this pattern yields arbitrary JavaScript execution in the process of any consumer that reaches this code path with attacker-influenced input. The package.json name ( self-sign ) also diverges from the require identifier used in the shipped documentation ( require('selfsign') ), a naming inconsistency that supports confusion with the legitimate selfsigned library.

Source: amazon-inspector (b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3)