@acedatacloud/nexior@3.329.26
<div align="center">
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe package is not concretely malicious, but it ships a consent-gated device-control capability with significant impact if enabled. Downgrade to warn for dangerous dual-use capability rather than blocking.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the Android app, enabling Computer Use, and authorizing a tool or preauthorizing tools in settings.
Impact
An authorized agent can view the screen and interact with the device UI.
Mechanism
Consent-gated Android accessibility/device-control agent bridge.
AI rationale
The package is not concretely malicious, but it ships a consent-gated device-control capability with significant impact if enabled. Downgrade to warn for dangerous dual-use capability rather than blocking.
Evidence
package.jsondist/assets/index-Cte8KZDs.jsdist/assets/mobileLocalExec-CciLUX99.jsdist/assets/solana-wallets-Co7nDG6W.js
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Android local-exec bridge exposes screenshot, UI dump, tap, type, key, and scroll tools.
- Per-tool consent can be persisted in localStorage grants.
- Runtime can preauthorize all computer tools and open accessibility settings.
- Bundled app includes dormant remote-update download logic.
Evidence against
- package.json has only a prepare hook (husky), not install/postinstall.
- Computer tools are Android-only and require explicit consent before invocation.
- No clipboard wallet-address replacement was confirmed; clipboard matches are wallet-library behavior.
- Remote-update path is disabled by constant rj=false in the shipped bundle.
Behavioral surface
ChildProcessCryptoNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
Source & flagged code
2 flaggeddist/assets/index-Cte8KZDs.jsView file
1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/aegis.min-C7H4WXnC.js","assets/rolldown-runtime--c01j_DQ.js","assets/vendor-highlight-BtIeKitL.js","assets/vendor-h...
L2: import{o as e,r as t,t as n}from"./rolldown-runtime--c01j_DQ.js";import{$ as r,A as i,At as a,B as o,Bt as s,C as c,D as l,Dt as u,E as d,Et as f,G as p,Gt as m,H as h,I as g,It as...
L3: `)>=0)return!1;return!0}function V(e,t){var n;if(e.indent===` `)n=` `;else if(typeof e.indent==`number`&&e.indent>0)n=C.call(Array(e.indent+1),` `);else return null;return{base:n,p...
...
L5: `+t.prev}function Oe(e,t){var n=ce(e),r=[];if(n){r.length=e.length;for(var i=0;i<e.length;i++)r[i]=me(e,i)?t(e[i],e):``}var a=typeof D==`function`?D(e):[],o;if(O){o={};for(var s=0;...
L6: `);l=u.pop()||``;for(let e of u){let i=e
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/assets/index-Cte8KZDs.jsView on unpkg · L1dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file
•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
kind = high_entropy_blob
sizeBytes = 9644
magicHex = [redacted]
High
Findings
1 Critical1 High3 Medium6 Low
CriticalClipboard Crypto Hijackdist/assets/index-Cte8KZDs.js
HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @acedatacloud/nexior@3.329.26.
See all versions of @acedatacloud/nexior for other recorded verdicts.
- Review the evidence and your use of @acedatacloud/nexior@3.329.26 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.