registry / @iflyrpa/actions / 4.0.9
@iflyrpa/actions@4.0.9
@iflyrpa/playwright 包中发布逻辑的具体实现
AI Security Review
scanned 1mo ago · by lpm-firewall-aiNo install-time hook or confirmed credential theft, persistence, or remote payload retrieval was found. The import-time opaque interpreter is a material unresolved risk despite its apparent use as a platform-request signer.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
Import the package, then invoke its Toutiao publishing action with cookies.
Impact
The concealed program cannot be fully source-audited; the exposed action can publish content through caller-supplied Toutiao credentials.
Mechanism
Opaque local signing code plus authenticated social-platform publishing.
AI rationale
No install-time hook or confirmed credential theft, persistence, or remote payload retrieval was found. The import-time opaque interpreter is a material unresolved risk despite its apparent use as a platform-request signer.
Evidence
dist/index.mjs
Network endpoints1
mp.toutiao.com
Decision evidence
public snapshotAI called this Suspicious at 85.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The entry bundle registers an obfuscated interpreter and immediately supplies it with a large encoded program.
- That opaque module is used to generate a signing value for a Toutiao publishing request that includes caller-provided cookies.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- No child-process use, environment harvesting, or non-platform exfiltration endpoint was found in the inspected entry bundle.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
5 flagged · loading sourcedist/bundle.jsView file
9716if (_0x383dd4 === _0x16c0e0) break;
L9717: _0x46fb59['push'](_0x46fb59['shift']());
L9718: } catch (_0x4fc071) {
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/bundle.jsView on unpkg · L9716•matchType = malicious_source_fingerprint_signature
signature = b6026286b03d87ae
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @iflyrpa/actions@4.1.0
matchedPath = dist/bundle.js
matchedIdentity = npm:QGlmbHlycGEvYWN0aW9ucw:4.1.0
similarity = 1.000
shingleOverlap = 3
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/bundle.jsView on unpkg11818};
L11819: const _0x2055b1 = new function() {
L11820: eval('this[\'a\'] = 2;');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/bundle.jsView on unpkg · L11818Findings
2 High4 Medium6 Low
HighObfuscated Payload Loaderdist/bundle.js
HighKnown Malware Source Fingerprint Signaturedist/bundle.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencedist/index.mjs
LowScripts Present
LowEvaldist/bundle.js
LowWeak Cryptodist/bundle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @iflyrpa/actions@4.0.9.
See all versions of @iflyrpa/actions for other recorded verdicts.
- Review the evidence and your use of @iflyrpa/actions@4.0.9 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.