registry / @gkd-kit/inspect / 0.0.1792378239741
@gkd-kit/inspect@0.0.1792378239741
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the inspected flagged source excerpts show ordinary parser, router, application utility, and UTF-8 download behavior. The scanner indicators do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
No malicious trigger was found; the manifest has no install lifecycle hook.
Impact
No harmful effect was established from the inspected source.
Mechanism
The flagged excerpts show parser WebAssembly loading, router state handling, application utility imports, and a byte-order mark in blob handling.
AI rationale
The manifest has no install lifecycle hook, and the inspected flagged source excerpts show ordinary parser, router, application utility, and UTF-8 download behavior. The scanner indicators do not establish malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json contains development and build scripts, with no install lifecycle hook.
- The flagged parser loads WebAssembly for supported runtimes, consistent with a parser implementation.
- The flagged router excerpt contains route state and navigation event names.
- The flagged SelectorTrackGraph file imports application runtime and utility modules.
- The flagged FileSaver file uses a byte-order mark in blob handling, consistent with UTF-8 download support.
Evidence against
- The scanner’s dynamic-loading, WebAssembly, and Unicode indicators correspond to parser runtime support and a UTF-8 byte-order mark in the inspected source; they do not establish an attack.
Behavioral surface
DynamicRequireEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/assets/retrace-wasm-CQxBnVuf.jsView file
1import{n as e}from"./chunk-DaTszU_Y.js";var t=e({charCodeAt:()=>i,compare:()=>o,concat:()=>r,equals:()=>s,fromCharCodeArray:()=>u,intoCharCodeArray:()=>p,length:()=>n,substring:()=...
L2: For more information, see https://kotl.in/wasm-help
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist/assets/retrace-wasm-CQxBnVuf.jsView on unpkg · L1dist/assets/FileSaver.min-Dur6rM9k.jsView file
16contains invisible/control Unicode U+FEFF (zero width no-break space)
`,[m(`&:not(:first-child)`,`margin-top: 8px`),d(`button`,[m(`&:not(:last-child)`,`margin-right: 8px;`)])])]),I=o({name:`Popconfirm`,props:Object.assign(Object.assign(Object.assign({},l.props),C),{positiveText:String,negativeText:String,sho
Critical
Trojan Source Unicode
Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.
dist/assets/FileSaver.min-Dur6rM9k.jsView on unpkg · L16Findings
1 Critical1 High4 Medium6 Low
CriticalTrojan Source Unicodedist/assets/FileSaver.min-Dur6rM9k.js
HighPrevious Version Dangerous Deltadist/assets/parser-qW4LX6ZD.js
MediumDynamic Requiredist/assets/retrace-wasm-CQxBnVuf.js
MediumNetwork
MediumShips Wasm Moduledist/assets/retrace-wasm-BnRfy_zS.wasm
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @gkd-kit/inspect@0.0.1792378239741.
See all versions of @gkd-kit/inspect for other recorded verdicts.
- Review the evidence and your use of @gkd-kit/inspect@0.0.1792378239741 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.