registry / @aladas-org/cryptocalc / 0.5.34
@aladas-org/cryptocalc@0.5.34
Cryptocurrency wallet generator
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe private-key logging creates a concrete local exposure risk, so a warning is appropriate. The reviewed evidence does not establish malicious exfiltration or an install-time attack.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
The Ethereum testnet wallet-generation path runs.
Impact
The key may be exposed through local application logs.
Mechanism
The code assigns the generated private key to a variable and passes it to the application logger.
AI rationale
The private-key logging creates a concrete local exposure risk, so a warning is appropriate. The reviewed evidence does not establish malicious exfiltration or an install-time attack.
Evidence
www/js/crypto/SimpleWallet/ethereum_api.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The Ethereum testnet wallet path assigns the generated private key and sends it to the application logger.
- The package manifest identifies the Electron main entrypoint; inspected manifest scripts contain no install lifecycle hook.
Evidence against
- The inspected source shows no network transfer of the logged key; the logging behavior is local.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
23 flagged · loading sourcewww/js/crypto/password_strength_evaluator.jsView file
449patternName = generic_password
severity = medium
line = 449
Medium
Secret Pattern
Package contains a possible secret pattern.
www/js/crypto/password_strength_evaluator.jsView on unpkg · L449452patternName = generic_password
severity = medium
line = 452
Medium
Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.jsView on unpkg · L452455patternName = generic_password
severity = medium
line = 455
Medium
Secret Pattern
Hardcoded password in www/js/crypto/password_strength_evaluator.js
www/js/crypto/password_strength_evaluator.jsView on unpkg · L455Findings
1 Critical10 High13 Medium6 Low
CriticalClipboard Crypto Hijackwww/js/view/_archives/main_gui.js
HighShips High Entropy Blob_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zip
HighPayload In Excluded Dirtests/_run_tests.py
HighSemantic Analysis Limited_archives/tests-prev/api/runners/_archives/test-simple-multi-coins.js#virtual:normalized:round1
HighKnown Malware Source Similaritywww/js/_main/electron_main.js
HighKnown Malware Source Similarity_archives/tests-prev/api/runners/_archives/diagnostic.js
HighKnown Malware Source Similarity_archives/tests-prev/api/runners/diagnostic.js
HighKnown Malware Source Similarity_archives/tests-prev/api/utils/test-runner.js
HighKnown Malware Source Similarity
Affected versions and remediation
This report applies to @aladas-org/cryptocalc@0.5.34.
See all versions of @aladas-org/cryptocalc for other recorded verdicts.
- Review the evidence and your use of @aladas-org/cryptocalc@0.5.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.