@adminide-stack/user-activity-browser
Sample core for higher packages to depend on
This report shows the evidence for @adminide-stack/user-activity-browser@1.1.3-alpha.114. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 22h ago · by lpm-firewall-aiThe main entry point appends an obfuscated base64 payload that executes at import time and retrieves and runs remote code using a host derived from Ethereum transaction data. This is concealed, automatic remote-code execution unrelated to the package's stated purpose.
Decision evidence
public snapshot- The manifest sets lib/index.js as the package main entry point.
- The entry point contains an eval(atob(...)) payload appended to the bundled library.
- Static decoding shows the payload runs automatically, queries Ethereum RPC and transaction-indexing services, derives a remote host from transaction data, then fetches and executes code and starts a detached Node process.
- The declared package purpose and ordinary library code concern browser activity tracking and GraphQL tracing.
- The manifest has no install lifecycle hooks; its scripts are for building, testing, and prepublishing.
Source & flagged code
5 flaggedThe entry point contains an eval(atob(...)) payload appended to the bundled library.
lib/index.jsView on unpkg · L595Static decoding shows the payload runs automatically, queries Ethereum RPC and transaction-indexing services, derives a remote host from transaction data, then fetches and executes code and starts a detached Node process.
lib/index.jsView on unpkg · L590Package source references a known benign dynamic code generation pattern.
lib/index.jsView on unpkg · L594Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.
package.jsonView on unpkgThe manifest sets lib/index.js as the package main entry point.
package.jsonView on unpkg · L2Findings
Affected versions and remediation
This report applies to @adminide-stack/user-activity-browser@1.1.3-alpha.114.
The versions list below shows the verdict for each recorded version.
- Avoid installing @adminide-stack/user-activity-browser@1.1.3-alpha.114. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.