@astralontop/math@1.0.0
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe page configures Google Analytics by default without an evident disclosure or opt-out, which meets the suspicious runtime telemetry rule. An automatically imported bundle is obfuscated, but the reviewed source does not establish a concrete malicious payload.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening the package entry page in a browser.
Impact
Runtime page analytics are sent without an evident user opt-out or disclosure in the inspected page. The obfuscated bundle also leaves some app behavior uncertain.
Mechanism
The page loads Google Tag Manager, configures Google Analytics, and imports the app bundle automatically.
AI rationale
The page configures Google Analytics by default without an evident disclosure or opt-out, which meets the suspicious runtime telemetry rule. An automatically imported bundle is obfuscated, but the reviewed source does not establish a concrete malicious payload.
Evidence
package.jsonindex.svgTg5Cp2Qx.jsassets/Cs2z9GQ5.js
Network endpoints1
www.googletagmanager.com
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json declares index.svg as the package entry and has no install lifecycle scripts.
- The page loads Google Tag Manager and configures Google Analytics by default when the entry page loads.
- The page automatically imports an obfuscated JavaScript application bundle.
- The app bundle defines a service-worker path, but the reviewed excerpts do not establish harmful behavior from it.
Evidence against
- No install, preinstall, or postinstall scripts are declared.
- The inspected source does not show credential collection, destructive actions, or an unrelated data collector.
Behavioral surface
Network
HighEntropyStringsMinifiedObfuscatedUrlStrings
Oversized source lightweight scan
Source & flagged code
6 flaggedTg5Cp2Qx.jsView file
1const _0x5ba4a2=_0x17e2;(function(_0x388fcf,_0x222f15){const _0x53f57e=_0x17e2,_0x254f6a=_0x388fcf();while(!![]){try{const _0x4748ac=parseInt(_0x53f57e(0x1e6))/0x1*(-parseInt(_0x53...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
Tg5Cp2Qx.jsView on unpkg · L1assets/Vb4Nw9Hz.wasmView file
•path = assets/Vb4Nw9Hz.wasm
kind = wasm_module
sizeBytes = 586279
magicHex = [redacted]
Medium
assets/Vb4Nw9Hz.jsView file
•path = assets/Vb4Nw9Hz.js
kind = oversized_source_file
sizeBytes = 5589222
magicHex = [redacted]
Findings
3 High6 Medium3 Low
HighObfuscated Payload LoaderTg5Cp2Qx.js
HighObfuscated
HighSemantic Analysis Limitedassets/DNXaPK4s.js#virtual:normalized:round1
MediumNetwork
MediumShips Wasm Moduleassets/Vb4Nw9Hz.wasm
MediumOversized Source Fileassets/Vb4Nw9Hz.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.svg
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @astralontop/math@1.0.0.
See all versions of @astralontop/math for other recorded verdicts.
- Review the evidence and your use of @astralontop/math@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.