registry / 9alma-app / 3.4.5

9alma-app@3.4.5

9alma — Activation & License Management Assistant. A web dashboard for M******ft product activation: convert I**********n *Ds (IID) into C*******tion *Ds (CID) with multi-account support, automatic OCR, a REST API, and self-update. For educational and tes

AI Security Review

scanned 3h ago · by lpm-firewall-ai

At CLI/runtime, the application can check for and apply a global npm self-update, then restart. Its web UI handles login credentials and refresh tokens through local same-origin routes; no separate exfiltration endpoint was confirmed.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs the 9alma CLI/application.

Impact

A compromised future registry release could replace the globally installed application; current source does not establish credential exfiltration or install-time execution.

Mechanism

Obfuscated runtime self-updater invokes global npm installation.

Rationale

Source inspection found no preinstall/install/postinstall hook, hidden credential-exfiltration endpoint, or concrete malicious chain. The obfuscated self-updater nevertheless creates unresolved supply-chain risk.

Evidence

package.jsonbin/9alma.jsdist/updater.jspublic/js/login.jspublic/js/dashboard.js

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/ is deliberately obfuscated, limiting auditability.

9alma-app@3.4.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code