Loading npm security reports…

@3dverse/livelink-agent: Suspicious npm security report (Warn) | LPM Firewall

registry / @3dverse/livelink-agent / 0.5.8

@3dverse/livelink-agent@0.5.8

Headless agent package for controlling 3dverse rendering sessions programmatically (Node.js and browser compatible)

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No confirmed attack surface was identified. Remote core loading, authentication, and playback file access support caller-invoked rendering and ingestion operations.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

The caller creates or joins a rendering session or configures a playback source; no automatic install attack was identified.

Impact

These operations provide rendering and ingestion functionality; inspected source showed no covert credential harvesting, destructive writes, or agent control mutation.

Mechanism

The library loads vendor rendering code, authenticates using caller-provided tokens, and reads caller-selected playback sources.

AI rationale

Inspected entrypoints contain package-aligned rendering and data ingestion behavior, with sensitive operations activated by caller configuration. No concrete malicious behavior or unresolved attack chain was established.

Network endpoints2

cdn.3dverse.com/livelink/core/1.0/api.3dverse.com/app/v1

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Source & flagged code

7 flagged · loading source

dist/index.cjsView file

2394static async #i(o) { L2395: let r = "https://cdn.3dverse.com/livelink/core/1.0/" + (o !== "prod" ? `core.${o}.mjs` : "core.mjs"); L2396: if (!a) return new Function("return import('" + r + "')"); L2397: let t = await (await fetch(r)).text(), d = await new Function("return import('node:vm')")(); L2398: return d.SourceTextModule ? (console.info("Using experimental VM SourceTextModule to load Livelink core"), async () => { ... L2401: }), await n.evaluate(), n.namespace; L2402: }) : new Function("return import('data:text/javascript;base64," + btoa(t) + "')"); L2403: } ... L4463: * Apply component values to the storage core without marking anything dirty or dispatching an L4464: * event. Private (non-virtual) so it is safe to call from the constructor. L4465: */ ... L8671: const id = Str

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.cjsView on unpkg · L2394

•Trigger-reachable chain: manifest.main -> dist/index.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg

2395let r = "https://cdn.3dverse.com/livelink/core/1.0/" + (o !== "prod" ? `core.${o}.mjs` : "core.mjs"); L2396: if (!a) return new Function("return import('" + r + "')"); L2397: let t = await (await fetch(r)).text(), d = await new Function("return import('node:vm')")();

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L2395

•matchType = normalized_sha256 matchedPackage = @3dverse/livelink-agent@0.5.3 matchedPath = dist/index.cjs matchedIdentity = npm:QDNkdmVyc2UvbGl2ZWxpbmstYWdlbnQ:0.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0648c27c06024119 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @3dverse/livelink-agent@0.5.3 matchedPath = dist/index.cjs matchedIdentity = npm:QDNkdmVyc2UvbGl2ZWxpbmstYWdlbnQ:0.5.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.cjsView on unpkg

8var __name = (target, value) => __defProp(target, "name", { value, configurable: true }); L9: var __commonJS = (cb, mod) => function __require() { L10: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L8

dist/index.mjsView file

•matchType = normalized_sha256 matchedPackage = @3dverse/livelink-agent@0.5.3 matchedPath = dist/index.mjs matchedIdentity = npm:QDNkdmVyc2UvbGl2ZWxpbmstYWdlbnQ:0.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

7 flagged

dist/index.cjsView file

Lines 1-28javascript

1"use strict";

2var __create = Object.create;

3var __defProp = Object.defineProperty;

4var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

5var __getOwnPropNames = Object.getOwnPropertyNames;

6var __getProtoOf = Object.getPrototypeOf;

7var __hasOwnProp = Object.prototype.hasOwnProperty;

8var __name = (target, value) => __defProp(target, "name", { value, configurable: true });

9var __commonJS = (cb, mod) => function __require() {

10 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L8

11 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

12 } catch (e2) {

13 throw mod = 0, e2;

14 }

15};

16var __export = (target, all) => {

17 for (var name in all)

18 __defProp(target, name, { get: all[name], enumerable: true });

19};

20var __copyProps = (to, from, except, desc) => {

21 if (from && typeof from === "object" || typeof from === "function") {

22 for (let key of __getOwnPropNames(from))

23 if (!__hasOwnProp.call(to, key) && key !== except)

24 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

25 }

26 return to;

27};

28var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

Lines 2374-2415javascript

2374var a = typeof process < "u" && process.versions != null && process.versions.node != null;

2375var s = class

•Trigger-reachable chain: manifest.main -> dist/index.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @3dverse/livelink-agent@0.5.3 matchedPath = dist/index.cjs matchedIdentity = npm:QDNkdmVyc2UvbGl2ZWxpbmstYWdlbnQ:0.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 0648c27c06024119 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @3dverse/livelink-agent@0.5.3 matchedPath = dist/index.cjs matchedIdentity = npm:QDNkdmVyc2UvbGl2ZWxpbmstYWdlbnQ:0.5.3 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.cjsView on unpkg

dist/index.mjsView file

•matchType = normalized_sha256 matchedPackage = @3dverse/livelink-agent@0.5.3 matchedPath = dist/index.mjs matchedIdentity = npm:QDNkdmVyc2UvbGl2ZWxpbmstYWdlbnQ:0.5.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg