registry / @gkd-kit/inspect / 0.0.1792345967493
@gkd-kit/inspect@0.0.1792345967493
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged runtime excerpts resolve to package-aligned parsing, routing, and retracing functions. The browser fetch retrieves a versioned WebAssembly asset from the package mirror; inspected source did not establish a concrete attack.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Using the browser application or its parser and retracing features.
Impact
No unconsented account action, credential collection, persistence, or destructive behavior was established.
Mechanism
The parser loads WebAssembly, including a versioned package asset in browser runtimes; the worker processes supplied log or crash text.
AI rationale
The manifest has no install lifecycle hook, and the flagged runtime excerpts resolve to package-aligned parsing, routing, and retracing functions. The browser fetch retrieves a versioned WebAssembly asset from the package mirror; inspected source did not establish a concrete attack.
Network endpoints1
registry.npmmirror.com/@gkd-kit/inspect/0.0.1792345967493/files/dist/assets/regex-wasm-5-mBVRip.wasm
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json defines development and build scripts but no install lifecycle hook or runtime entrypoint.
- The SQL-related bundle excerpt contains path normalization logic.
- The worker accepts register, log, and crash-retrace messages and returns results through its message channel.
- The router excerpt resolves relative URL paths.
- The parser loads WebAssembly in supported runtimes and fetches a versioned package asset in browsers.
- The selector graph and FileSaver excerpts contain ordinary utility and browser-download code.
Evidence against
Behavioral surface
DynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/assets/FileSaver.min-Cmba8ePE.jsView file
16contains invisible/control Unicode U+FEFF (zero width no-break space)
`,[m(`&:not(:first-child)`,`margin-top: 8px`),d(`button`,[m(`&:not(:last-child)`,`margin-right: 8px;`)])])]),I=o({name:`Popconfirm`,props:Object.assign(Object.assign(Object.assign({},l.props),C),{positiveText:String,negativeText:String,sho
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/assets/FileSaver.min-Cmba8ePE.jsView on unpkg · L16dist/assets/retrace-wasm-BnRfy_zS.wasmView file
•path = dist/assets/retrace-wasm-BnRfy_zS.wasm
kind = wasm_module
sizeBytes = 978294
magicHex = [redacted]
Medium
Ships Wasm Module
Package ships WebAssembly modules.
dist/assets/retrace-wasm-BnRfy_zS.wasmView on unpkgFindings
1 Critical2 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/FileSaver.min-Cmba8ePE.js
HighSemantic Analysis Limiteddist/assets/sql-wasm-browser-1hpCzqJQ.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/assets/parser-DRXiV3RI.js
MediumDynamic Require
MediumNetwork
MediumShips Wasm Moduledist/assets/retrace-wasm-BnRfy_zS.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1792345967493.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1792345967493 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.