@aladas-org/cryptocalc@0.5.32
Cryptocurrency wallet generator
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe scanner's similarity hints alone do not establish malware. Source inspection found a conditional shell-injection risk in the application's Linux folder-opening flow, supporting a warning rather than a malware block.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user invokes the application's open-output-folder action on Linux.
Impact
A specially crafted path could cause unintended shell command execution in the application's user context.
Mechanism
The saved path is inserted inside double quotes in a command passed to child_process.exec without shell-safe argument handling.
AI rationale
The scanner's similarity hints alone do not establish malware. Source inspection found a conditional shell-injection risk in the application's Linux folder-opening flow, supporting a warning rather than a malware block.
Evidence
www/js/_main/electron_main.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- On Linux, the Electron entrypoint interpolates the output-folder path into a shell command without escaping embedded quotes or shell syntax.
- That path is stored from the wallet-save result, and the shell command runs when the user requests opening the output folder.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its scripts are application, build, and test commands.
- The inspected entrypoint shows ordinary application file and window handling; the shell invocation is tied to opening the saved output folder.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
26 flagged · loading sourcewww/js/crypto/password_strength_evaluator.jsView file
449patternName = generic_password
severity = medium
line = 449
Medium
Secret Pattern
Package contains a possible secret pattern.
www/js/crypto/password_strength_evaluator.jsView on unpkg · L449452patternName = generic_password
severity = medium
line = 452
Medium
Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.jsView on unpkg · L452455patternName = generic_password
severity = medium
line = 455
Medium
Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.jsView on unpkg · L455Findings
1 Critical13 High13 Medium6 Low
CriticalClipboard Crypto Hijackwww/js/view/_archives/main_gui.js
HighShips High Entropy Blob_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip
HighPayload In Excluded Dirtests/_run_tests.py
HighSemantic Analysis Limited_archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1
HighKnown Malware Source Similaritywww/js/_main/electron_main.js
HighKnown Malware Source Similarity_archives/tests-prev/api/runners/_archives/diagnostic.js
HighKnown Malware Source Similarity_archives/tests-prev/api/runners/diagnostic.js
HighKnown Malware Source Similarity_archives/tests-prev/api/utils/test-runner.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @aladas-org/cryptocalc@0.5.32.
See all versions of @aladas-org/cryptocalc for other recorded verdicts.
- Review the evidence and your use of @aladas-org/cryptocalc@0.5.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.