@adminide-stack/client-redux@0.0.16-18
GraphQL for sample
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe package entry point automatically evaluates concealed Base64 code, and the hidden routine includes another eval and a Node script spawning path. This is an import-time loader unrelated to the package's stated purpose, so the package is malicious.
Decision evidence
public snapshot- The package main entry is lib/index.js, so its top-level code runs when the package is imported.
- lib/index.js executes a Base64-decoded string with eval; the decoded prefix identifies the code as an npm injection.
- The concealed routine includes another eval, a spawnNodeScript call, and URL construction, consistent with a hidden code loader.
- package.json declares no install, preinstall, or postinstall lifecycle hook.
- The manifest describes the package as GraphQL/Redux client code, but the import-time loader is unrelated to that purpose.
Source & flagged code
6 flaggedlib/index.js executes a Base64-decoded string with eval; the decoded prefix identifies the code as an npm injection.
lib/index.jsView on unpkg · L292The concealed routine includes another eval, a spawnNodeScript call, and URL construction, consistent with a hidden code loader.
lib/index.jsView on unpkg · L292Package source references a known benign dynamic code generation pattern.
lib/index.jsView on unpkg · L291Findings
Affected versions and remediation
This report applies to @adminide-stack/client-redux@0.0.16-18.
See all versions of @adminide-stack/client-redux for other recorded verdicts.
- Avoid installing @adminide-stack/client-redux@0.0.16-18. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.