registry / @leofcoin/chain / 1.10.15
@leofcoin/chain@1.10.15
Official javascript implementation
AI Security Review
scanned 21d ago · by lpm-firewall-aiThe inspected runtime behavior is consistent with peer discovery and blockchain contract execution, and the package manifest has no install lifecycle hook. The static execution and network signals do not establish malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Node initialization fetches the public IP; DHT peer selection requests location data, while validator participation requires a caller to invoke its API method.
Impact
The node’s public IP is sent for peer-location routing; no credential theft, unauthorized account action, or destructive behavior was identified.
Mechanism
The node uses public-IP geolocation to select a nearby peer, and the worker compiles decoded contract source for execution.
AI rationale
The inspected runtime behavior is consistent with peer discovery and blockchain contract execution, and the package manifest has no install lifecycle hook. The static execution and network signals do not establish malicious behavior.
Evidence
package.jsonexports/browser/chain.jsexports/browser/node-browser-BYi7D_oa.jsexports/workers/machine-worker.js
Network endpoints2
icanhazip.com/whereis.leofcoin.org/?ip=${address}
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the reviewed modules and lists ordinary development and build scripts; no install lifecycle hook was found.
- Node initialization fetches the node’s public IP, and DHT peer selection uses geolocation to choose a nearby provider.
- The worker compiles decoded blockchain contract source with execution bridges for contract processing.
- Validator participation is exposed as an explicit method that takes an address and signs the related transaction.
Evidence against
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedexports/browser/workers/machine-worker.jsView file
8534const source = instrumentContractSource(new TextDecoder().decode(decoded.contract));
L8535: const func = new Function('__lfcMeter', 'Date', 'crypto', source);
L8536: const Contract = func(meterBridge, dateBridge, cryptoBridge);
Low
Eval
Package source references a known benign dynamic code generation pattern.
exports/browser/workers/machine-worker.jsView on unpkg · L8534exports/browser/node-browser-BYi7D_oa.jsView file
453* ```js
L454: * const {createHash} = await import('@leofcoin/crypto')
L455: * createHash(data, algorithm)
Medium
Dynamic Require
Package source references dynamic require/import behavior.
exports/browser/node-browser-BYi7D_oa.jsView on unpkg · L453exports/browser/chain.jsView file
160Cross-file remote execution chain: exports/browser/chain.js spawns exports/browser/workers/machine-worker.js; helper contains network access plus dynamic code execution.
L160: typeof process === 'object' &&
L161: process.env &&
L162: process.env.NODE_DEBUG &&
...
L3104: let nonce = await globalThis.accountsStore.get(address);
L3105: nonce = Number(new TextDecoder().decode(nonce));
L3106: const maxPending = this.getMaxPendingNonce(address);
...
L3157: }
L3158: async sendTransaction(message) {
L3159: if (!this.isTransactionMessage(message)) message = await new TransactionMessage(message);
...
L3526: return new Promise((resolve, reject) => {
L3527: import('child_process').then(({ fork }) => {
L3528: const child = fork(url, ['easy-worker-child'], options);
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
exports/browser/chain.jsView on unpkg · L160package.jsonView file
6"exports": {
"./node": {
"import": "./exports/node.js",
"types": "./exports/node.d.ts"
},
"./chain": {
"import": "./exports/chain.js",
"types": "./exports/chain.d.ts"
},
"./consensus/beacon": {
"import": "./exports/beacon.js",
Low
Suspicious Lifecycle Evidence
package.json exposes the reviewed modules and lists ordinary development and build scripts; no install lifecycle hook was found.
package.jsonView on unpkg · L658"scripts": {
"np": "np",
"watch": "rollup -c -w --silent error --cache true",
"prettier": "prettier src --config ./../../.prettierrc --write",
"w": "rollup -c -w",
"docs": "sh ./node_modules/.bin/esdoc src/chain.js",
"workers": "cp ./../workers/src/** ./workers",
"demo": "jsproject --serve ./ --port
Low
Suspicious Lifecycle Evidence
package.json exposes the reviewed modules and lists ordinary development and build scripts; no install lifecycle hook was found.
package.jsonView on unpkg · L58Findings
1 High3 Medium8 Low
HighCross File Remote Execution Contextexports/browser/chain.js
MediumDynamic Requireexports/browser/node-browser-BYi7D_oa.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.15.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.15 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.