registry / @acedatacloud/nexior / 3.329.9
@acedatacloud/nexior@3.329.9
<div align="center">
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe scanner's clipboard finding is a false positive: the bundled code provides general clipboard support and uses it to copy the user's displayed wallet address. The prepare hook is Husky-only and ships no hook files, with no install-time malicious behavior established.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User opens the wallet UI and selects Copy address.
Impact
No unconsented clipboard replacement or data exfiltration was found.
Mechanism
Copies the currently connected wallet public address to the clipboard.
AI rationale
The scanner's clipboard finding is a false positive: the bundled code provides general clipboard support and uses it to copy the user's displayed wallet address. The prepare hook is Husky-only and ships no hook files, with no install-time malicious behavior established.
Evidence
package.jsondist/assets/solana-wallets-vue-eNNjqwtC.js
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepare: husky.
- No .husky hook files are present in the package.
- The flagged wallet bundle's clipboard read/write helper is library code; its application use copies the connected wallet's own public address.
- No credential harvesting, clipboard address replacement, shell execution, or exfiltration chain was confirmed.
Behavioral surface
ChildProcessCryptoNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings
Source & flagged code
2 flaggeddist/assets/solana-wallets-vue-eNNjqwtC.jsView file
1import{A as e,At as t,B as n,C as r,Ct as i,Dt as a,E as o,Et as s,Gt as c,I as l,Jt as u,K as d,Kt as f,L as p,M as m,Mt as h,N as g,Ot as _,Q as v,T as y,V as b,at as x,ft as S,g...
L2: `;t+=`${e.address}`,e.statement&&(t+=`
...
L6: ${n.join(`
L7: `)}`),t}var V={ERROR_ASSOCIATION_PORT_OUT_OF_RANGE:`ERROR_ASSOCIATION_PORT_OUT_OF_RANGE`,ERROR_REFLECTOR_ID_OUT_OF_RANGE:`ERROR_REFLECTOR_ID_OUT_OF_RANGE`,ERROR_FORBIDDEN_WALLET_BA...
L8: ]))+`;G.KANJI=new RegExp(e,`g`),G.BYTE_KANJI=RegExp(`[^A-Z0-9 $%*+\\-./:]+`,`g`),G.BYTE=new RegExp(t,`g`),G.NUMERIC=RegExp(`[0-9]+`,`g`),G.ALPHANUMERIC=RegExp(`[A-Z $%*+\\-./:]+`,`...
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/assets/solana-wallets-vue-eNNjqwtC.jsView on unpkg · L1dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file
•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
kind = high_entropy_blob
sizeBytes = 9644
magicHex = [redacted]
High
Ships High Entropy Blob
Findings
1 Critical1 High3 Medium6 Low
CriticalClipboard Crypto Hijackdist/assets/solana-wallets-vue-eNNjqwtC.js
HighShips High Entropy Blobdist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2
MediumNetwork
MediumProtestware
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowObfuscated
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @acedatacloud/nexior@3.329.9.
See all versions of @acedatacloud/nexior for other recorded verdicts.
- Review the evidence and your use of @acedatacloud/nexior@3.329.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.