registry / @baanx/common / 9.9.9

@baanx/common@9.9.9

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No attack surface was identified in the package source.

Static reason

No blocking static signals were detected.

Trigger

Importing the declared entrypoint does not activate any harmful behavior.

Impact

No file, network, credential, process, or persistence effect was identified.

Mechanism

The entrypoint only exports an empty object, and the manifest has no install lifecycle scripts.

AI rationale

Static source inspection found a minimal manifest with no lifecycle hook and an inert entrypoint. No concrete malicious behavior is present.

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16485

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @baanx/common (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (d272d47a4b0d81c2aca10da98d90d30033d41d50bd3aeb3b925fb99cbe40b3f3) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares only a test script and sets index.js as the entrypoint; it contains no install lifecycle hook.
The entrypoint only exports an empty object, with no runtime behavior.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 134 B of source

Source & flagged code

2 flagged

package.jsonView file

5"main": "index.js", "scripts": { "test": "node test/smoke.js" }, "files": ["index.js", "README.md", "test"],

High

Suspicious Lifecycle Evidence

The manifest declares only a test script and sets index.js as the entrypoint; it contains no install lifecycle hook.

package.jsonView on unpkg · L5

index.jsView file

1'use strict'; /** * @baanx/common * Placeholder entrypoint. Full implementation ships in the next release. */ module.exports = {};

High

Ai Review Evidence

The entrypoint only exports an empty object, with no runtime behavior.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

5"main": "index.js", "scripts": { "test": "node test/smoke.js" }, "files": ["index.js", "README.md", "test"],

High

Suspicious Lifecycle Evidence

The manifest declares only a test script and sets index.js as the entrypoint; it contains no install lifecycle hook.

package.jsonView on unpkg · L5

index.jsView file

1'use strict'; /** * @baanx/common * Placeholder entrypoint. Full implementation ships in the next release. */ module.exports = {};

High

Ai Review Evidence

The entrypoint only exports an empty object, with no runtime behavior.

index.jsView on unpkg · L1

Findings

2 High1 Low

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

LowScripts Present

Affected versions and remediation

This report applies to @baanx/common@9.9.9.

See version security history for other recorded verdicts.

Avoid installing @baanx/common@9.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 01:30:06.765Z (UTC).

Source advisory published: 2026-09-24 00:41:44.000Z (UTC).