registry / @iflyrpa/actions / 4.1.2
@iflyrpa/actions@4.1.2
@iflyrpa/playwright 包中发布逻辑的具体实现
AI Security Review
scanned 1mo ago · by lpm-firewall-aiStatic inspection found no lifecycle hook or concrete malicious behavior. Network reporting is action-triggered and restricted to package-defined hosts.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
A caller invokes a publishing action with its own parameters.
Impact
No covert install-time action, unrestricted credential forwarding, persistence, or destructive behavior was established.
Mechanism
The invoked publish flow conditionally sends a log using a caller-provided token to a fixed service endpoint.
AI rationale
Static inspection found no lifecycle hook or concrete malicious behavior. Network reporting is action-triggered and restricted to package-defined hosts.
Network endpoints2
turbodesk.xfyun.cnfetdev.iflysec.com
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes library entrypoints and its scripts contain only build and development commands, with no install lifecycle hook.
- The bundled reporting function returns when no caller token is supplied and selects only one of two fixed service hosts before sending a publish log.
- The reporting function is invoked after a publish operation with caller-provided publish parameters.
Evidence against
- The bundle contains post-publish telemetry and a fixed error-webhook endpoint, but the inspected reporting destination is package-fixed and activation follows an invoked action.
Behavioral surface
CryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
4 flagged · loading sourcedist/bundle.jsView file
9716if (_0x383dd4 === _0x16c0e0) break;
L9717: _0x46fb59['push'](_0x46fb59['shift']());
L9718: } catch (_0x4fc071) {
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/bundle.jsView on unpkg · L9716•matchType = malicious_source_fingerprint_signature
signature = b6026286b03d87ae
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @iflyrpa/actions@4.1.0
matchedPath = dist/bundle.js
matchedIdentity = npm:QGlmbHlycGEvYWN0aW9ucw:4.1.0
similarity = 1.000
shingleOverlap = 3
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/bundle.jsView on unpkg11818};
L11819: const _0x2055b1 = new function() {
L11820: eval('this[\'a\'] = 2;');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/bundle.jsView on unpkg · L11818Findings
3 High3 Medium6 Low
HighObfuscated Payload Loaderdist/bundle.js
HighObfuscated
HighKnown Malware Source Fingerprint Signaturedist/bundle.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist/bundle.js
LowWeak Cryptodist/bundle.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @iflyrpa/actions@4.1.2.
See all versions of @iflyrpa/actions for other recorded verdicts.
- Review the evidence and your use of @iflyrpa/actions@4.1.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.