registry / @acedatacloud/nexior / 3.324.30
@acedatacloud/nexior@3.324.30
⚠ Under review<div align="center">
AI Security Review
scanned 4mo ago · by lpm-firewall-aiThe flagged clipboard behavior is a user-clicked copy of the connected wallet public address, not address substitution. The package includes powerful but explicitly consent-gated Android automation features and no concrete malicious chain.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User enables Computer Use and approves a foreground tool action.
Impact
User-authorized screen/UI interaction only.
Mechanism
Consent-gated local Android computer-use bridge
AI rationale
The flagged clipboard behavior is a user-clicked copy of the connected wallet public address, not address substitution. The package includes powerful but explicitly consent-gated Android automation features and no concrete malicious chain.
Evidence
package.jsondist/assets/mobileLocalExec-CF5P-j35.jsdist/assets/solana-wallets-vue-DutFGlU3.jsdist/sw.jsdist/index.htmldist/assets/index-Cf679Gpt.js
Network endpoints1
www.googletagmanager.com/gtag/js?id=G-Y6N02K05B8
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Why the final policy warns
The AI recommended clean, but the final policy action is warn. This report does not record a matching static-policy override reason.
Evidence for AI clean decision
- Android bundle exposes screenshot, UI, tap, type, and key tools.
- Wallet bundle supports signing and transaction submission.
Evidence against
- package.json has only prepare: husky; no install/postinstall hook.
- Mobile computer tools require an enabled local setting and foreground per-action consent.
- Clipboard code only copies the connected wallet's displayed public address on click.
- No source evidence of wallet-address replacement, credential harvesting, or exfiltration.
- Service worker only displays push notifications and opens a supplied deep link.
- No package-owned AI-agent config or foreign control-surface writes found.
Behavioral surface
ChildProcessCryptoNetworkWebSocket
HighEntropyStringsMinifiedObfuscated
Source & flagged code
2 flaggeddist/assets/solana-wallets-vue-DutFGlU3.jsView file
1import{A as e,At as t,B as n,C as r,Ct as i,Dt as a,E as o,Et as s,Gt as c,I as l,Jt as u,K as d,Kt as f,L as p,M as m,Mt as h,N as g,Ot as _,Q as v,T as y,V as b,at as x,ft as S,g...
L2: `;t+=`${e.address}`,e.statement&&(t+=`
...
L6: ${n.join(`
L7: `)}`),t}var V={ERROR_ASSOCIATION_PORT_OUT_OF_RANGE:`ERROR_ASSOCIATION_PORT_OUT_OF_RANGE`,ERROR_REFLECTOR_ID_OUT_OF_RANGE:`ERROR_REFLECTOR_ID_OUT_OF_RANGE`,ERROR_FORBIDDEN_WALLET_BA...
L8: ]))+`;G.KANJI=new RegExp(e,`g`),G.BYTE_KANJI=RegExp(`[^A-Z0-9 $%*+\\-./:]+`,`g`),G.BYTE=new RegExp(t,`g`),G.NUMERIC=RegExp(`[0-9]+`,`g`),G.ALPHANUMERIC=RegExp(`[A-Z $%*+\\-./:]+`,`...
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/assets/solana-wallets-vue-DutFGlU3.jsView on unpkg · L1dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file
•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
kind = high_entropy_blob
sizeBytes = 9644
magicHex = [redacted]
High
Ships High Entropy Blob
Findings
1 Critical1 High3 Medium6 Low
CriticalClipboard Crypto Hijackdist/assets/solana-wallets-vue-DutFGlU3.js
HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @acedatacloud/nexior@3.324.30.
See all versions of @acedatacloud/nexior for other recorded verdicts.
- Review the evidence and your use of @acedatacloud/nexior@3.324.30 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.