Command Injection in NPM OCR Package Threatens Application Security

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The node-ts-ocr NPM package version 1.0.15 contains a critical OS command injection vulnerability in its invokeImageOcr function that allows attackers to execute arbitrary system commands. This vulnerability (CVE-2025-63705, CVSS 8.8) affects any application integrating this package without proper input validation, potentially compromising servers, stealing sensitive data, or establishing persistent access. Organizations using this package for document processing, receipt scanning, or image-to-text functionality face immediate risk, particularly in SaaS platforms, document management systems, and automation workflows that handle untrusted image inputs.

Casky's 419 mapped skills detect the attack patterns underlying this vulnerability by analyzing initial access methods (TA0001), command execution techniques (TA0002), and post-exploitation command and control activities (TA0043). Practitioners using Casky would observe findings highlighting unsanitized function parameters passed to system calls, suspicious child process spawning from Node.js applications, and network indicators associated with command exfiltration. Claude's extended reasoning capabilities correlate these signals across the attack chain—from how an attacker might craft a malicious image filename to trigger injection, through execution on the target system, to lateral movement attempts—enabling security teams to identify both vulnerable code patterns in their dependencies and active exploitation attempts in their environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2025-63705.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2025-63705

Casky has 419 skills that investigate the attack patterns behind CVE-2025-63705. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn