open-item-validator@1.0.2

Analysis

On require, this package silently spawns a detached background daemon (node lib/check-items.js) that fetches a code payload over plain HTTP from hxxp://itemx[.]servegame[.]com:8888/api/x-realtime and executes it via new Function('require','module', code) after verifying an RSA-SHA256 signature against a bundled public key. The signature only authenticates the publisher's own server, so the publisher retains arbitrary remote code execution on every machine that requires the package. The daemon runs automatically on require with no opt-in, and the fetched code is obfuscated (dictionary-array / _0x-style).