registry / @baanx/domain / 9.9.9

@baanx/domain@9.9.9

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No attack surface was identified in the inspected package source.

Static reason

No blocking static signals were detected.

Trigger

Importing the package loads its empty entrypoint.

Impact

No file, network, process, credential, or persistence action was identified.

Mechanism

The entrypoint only exports an empty object; the manifest has no automatic lifecycle script.

AI rationale

The package contains a minimal manifest and inert entrypoint, with no lifecycle execution or suspicious runtime primitives.

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-16486

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @baanx/domain (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (a18b786cad636e5b1ac77f23ac054b08d161ad5981c0ed731e14b116167d4859) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE

Decision evidence

public snapshot

AI called this Clean at 99.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The manifest declares only a test script and an index.js entrypoint; it has no install lifecycle hooks.
The entrypoint exports an empty object and contains no runtime behavior.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 134 B of source

Source & flagged code

2 flagged

package.jsonView file

2"name": "@baanx/domain", "version": "9.9.9", "description": "Domain models and DTO builders for wallet tokens and swap quotes", "main": "index.js", "scripts": { "test": "node test/smoke.js" },

High

Suspicious Lifecycle Evidence

The manifest declares only a test script and an index.js entrypoint; it has no install lifecycle hooks.

package.jsonView on unpkg · L2

index.jsView file

1'use strict'; /** * @baanx/domain * Placeholder entrypoint. Full implementation ships in the next release. */ module.exports = {};

High

Ai Review Evidence

The entrypoint exports an empty object and contains no runtime behavior.

index.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

2"name": "@baanx/domain", "version": "9.9.9", "description": "Domain models and DTO builders for wallet tokens and swap quotes", "main": "index.js", "scripts": { "test": "node test/smoke.js" },

High

Suspicious Lifecycle Evidence

The manifest declares only a test script and an index.js entrypoint; it has no install lifecycle hooks.

package.jsonView on unpkg · L2

index.jsView file

1'use strict'; /** * @baanx/domain * Placeholder entrypoint. Full implementation ships in the next release. */ module.exports = {};

High

Ai Review Evidence

The entrypoint exports an empty object and contains no runtime behavior.

index.jsView on unpkg · L1

Findings

2 High1 Low

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

LowScripts Present

Affected versions and remediation

This report applies to @baanx/domain@9.9.9.

See version security history for other recorded verdicts.

Avoid installing @baanx/domain@9.9.9. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-30 01:15:06.057Z (UTC).

Source advisory published: 2026-09-24 00:41:45.000Z (UTC).