@acedatacloud/nexior@3.382.1
<div align="center">
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe clipboard alert is not supported by the inspected wallet-library code, which behaves like a generic copy helper. However, the page automatically enables Google Analytics without an apparent disclosure or opt-out, so this is suspicious runtime telemetry rather than a confirmed malicious attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
When the application page loads, or when it becomes idle if it has not finished loading.
Impact
Page-view and related analytics data may be sent to Google without an apparent disclosure or opt-out in the inspected page source.
Mechanism
dist/index.html configures gtag with a fixed GA4 measurement ID and loads the Google Tag Manager gtag script.
AI rationale
The clipboard alert is not supported by the inspected wallet-library code, which behaves like a generic copy helper. However, the page automatically enables Google Analytics without an apparent disclosure or opt-out, so this is suspicious runtime telemetry rather than a confirmed malicious attack.
Evidence
dist/index.html
Network endpoints1
www.googletagmanager.com/gtag/js?id=G-Y6N02K05B8
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- dist/index.html configures Google Analytics 4 with a fixed measurement ID and automatically loads its script after page load or when the page is idle.
- No analytics disclosure or consent control was found in the inspected page source.
Evidence against
- The flagged wallet-library clipboard helper reads only when configured to do so and copies the value passed to it; the inspected code shows no wallet-address matching or substitution.
- package.json packages dist/ and has no main or exports entry, consistent with a web application rather than an automatically imported Node library.
Behavioral surface
CryptoEvalFilesystemNetworkWebSocket
HighEntropyStringsMinifiedPossibleObfuscationTelemetryUrlStrings
Source & flagged code
3 flaggeddist/assets/solana-wallets-vue-C76KtNoS.jsView file
1import{A as e,At as t,B as n,C as r,Ct as i,Dt as a,E as o,Et as s,Gt as c,I as l,Jt as u,K as d,Kt as f,L as p,M as m,Mt as h,N as g,Ot as _,Q as v,T as y,V as b,at as x,ft as S,g...
L2: `;t+=`${e.address}`,e.statement&&(t+=`
...
L6: ${n.join(`
L7: `)}`),t}var V={ERROR_ASSOCIATION_PORT_OUT_OF_RANGE:`ERROR_ASSOCIATION_PORT_OUT_OF_RANGE`,ERROR_REFLECTOR_ID_OUT_OF_RANGE:`ERROR_REFLECTOR_ID_OUT_OF_RANGE`,ERROR_FORBIDDEN_WALLET_BA...
L8: ]))+`;G.KANJI=new RegExp(e,`g`),G.BYTE_KANJI=RegExp(`[^A-Z0-9 $%*+\\-./:]+`,`g`),G.BYTE=new RegExp(t,`g`),G.NUMERIC=RegExp(`[0-9]+`,`g`),G.ALPHANUMERIC=RegExp(`[A-Z $%*+\\-./:]+`,`...
Critical
Clipboard Crypto Hijack
Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.
dist/assets/solana-wallets-vue-C76KtNoS.jsView on unpkg · L1dist/assets/List-GjDynsR3.js#virtual:string-array:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3
High
Semantic Analysis Limited
Findings
1 Critical1 High3 Medium7 Low
CriticalClipboard Crypto Hijackdist/assets/solana-wallets-vue-C76KtNoS.js
HighSemantic Analysis Limiteddist/assets/List-GjDynsR3.js#virtual:string-array:round1
MediumNetwork
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.html
LowNon Install Lifecycle Scripts
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @acedatacloud/nexior@3.382.1.
See all versions of @acedatacloud/nexior for other recorded verdicts.
- Review the evidence and your use of @acedatacloud/nexior@3.382.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.