Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@kerebron/legacy-compat@0.8.9: Clean npm security report (Allow) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 10 low-signal pattern(s) reviewed.

View on npm All versions

registry / @kerebron/legacy-compat / 0.8.9

@kerebron/legacy-compat@0.8.9

Packages from NPM can be directly accessed using https://cdn.jsdelivr.net.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. Runtime network access is limited to explicit editor asset loading with a caller-supplied base URL.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

Consumer imports the package and invokes editor or createAssetLoad APIs.

Impact

No unconsented install-time action, credential access, persistence, or exfiltration established.

Mechanism

Browser editor bundle with optional caller-directed asset/WASM fetches.

Rationale

The scanner findings map to bundled editor/tree-sitter functionality: Emscripten-generated evaluation and user-configured asset loading. Direct inspection found no concrete malicious chain.

Evidence

package.jsondist/kerebron.jsdist/kerebron.cjsREADME.md

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/kerebron.js exposes caller-configured asset fetching and WASM loading.
dist/kerebron.js contains Emscripten eval helpers for its embedded tree-sitter runtime.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence against

package.json has no lifecycle scripts or bin entrypoint.
Entrypoints are bundled browser editor exports only.
Asset fetch URL is constructed from the caller-supplied base URL.
No credential harvesting, shell/process execution, filesystem writes, or exfiltration found.
The reported invisible character is a UI zero-width space at dist/kerebron.js:19527.

Behavioral surface

Source

ChildProcessEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 2.25 MB of source, external domains: code.google.com, github.com, prosemirror.net, www.w3.org

Source & flagged code

4 flagged · loading source

dist/kerebron.cjsView file

137contains invisible/control Unicode U+200B (zero width space) <U+200B>`);let e=this.save();e&&(e.start=--e.end,this.restore(e))}else insert$1(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/kerebron.cjsView on unpkg · L137

•Trigger-reachable chain: manifest.main -> dist/kerebron.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/kerebron.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9d93f807af62cb09 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kerebron/legacy-compat@0.8.6 matchedPath = dist/kerebron.cjs matchedIdentity = npm:QGtlcmVicm9uL2xlZ2FjeS1jb21wYXQ:0.8.6 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/kerebron.cjsView on unpkg

112${t}`)}let r=e.clone();try{n=await WebAssembly.compileStreaming(e)}catch(e){console.error(`wasm streaming compile failed:`,e),console.error(`falling back to ArrayBuffer instantiati... L113: ${JSON.stringify(a,null,2)}`),Error(`Language.load failed: no language function found in Wasm file`);return new e(INTERNAL,r[o]())}};async function Module2(moduleArg={}){var module... L114: `)[0],s=o.match(QUERY_WORD_REGEX)?.[0]??``;switch(C._free(r),e){case QueryErrorKind.Syntax:throw new QueryError(QueryErrorKind.Syntax,{suffix:`${a}: '${o}'...`},a,0);case QueryErro...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kerebron.cjsView on unpkg · L112

Findings

2 Critical1 High2 Medium5 Low

CriticalTrojan Source Unicodedist/kerebron.cjs

CriticalTrigger Reachable Dangerous Capabilitydist/kerebron.cjs

HighKnown Malware Source Fingerprint Signaturedist/kerebron.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowEvaldist/kerebron.cjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

96%Pass

Verdict confidence

IntentBenign

False-positive riskLow

Review stagesource_first_review

Firewall policyNo policy match

Package metadata

npm

Maintainersggodlewski, horner

Version0.8.12

PublishedJul 28, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size1.89 MB

Files18

Runtime surface

package.json

Entrypointsmain → ./dist/kerebron.cjsmodule → ./dist/kerebron.jsexports map

RuntimeNo engine / OS / CPU constraints

Artifact8.05 MB · 18 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

ChildProcessEvalFilesystemNetworkHighEntropyStringsMinifiedObfuscatedUrlStringsManifest: clean

LPM CLI

Source & flagged code

4 flagged

dist/kerebron.cjsView file

137contains invisible/control Unicode U+200B (zero width space) <U+200B>`);let e=this.save();e&&(e.start=--e.end,this.restore(e))}else insert$1(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/kerebron.cjsView on unpkg · L137

•Trigger-reachable chain: manifest.main -> dist/kerebron.cjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/kerebron.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9d93f807af62cb09 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kerebron/legacy-compat@0.8.6 matchedPath = dist/kerebron.cjs matchedIdentity = npm:QGtlcmVicm9uL2xlZ2FjeS1jb21wYXQ:0.8.6 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/kerebron.cjsView on unpkg

112${t}`)}let r=e.clone();try{n=await WebAssembly.compileStreaming(e)}catch(e){console.error(`wasm streaming compile failed:`,e),console.error(`falling back to ArrayBuffer instantiati... L113: ${JSON.stringify(a,null,2)}`),Error(`Language.load failed: no language function found in Wasm file`);return new e(INTERNAL,r[o]())}};async function Module2(moduleArg={}){var module... L114: `)[0],s=o.match(QUERY_WORD_REGEX)?.[0]??``;switch(C._free(r),e){case QueryErrorKind.Syntax:throw new QueryError(QueryErrorKind.Syntax,{suffix:`${a}: '${o}'...`},a,0);case QueryErro...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/kerebron.cjsView on unpkg · L112