@leofcoin/chain@1.10.18
Official javascript implementation
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe browser client performs an undisclosed public IP lookup automatically during initialization, with a related geolocation request used for closest-peer selection. The behavior has a plausible networking purpose, so this is a warning-level privacy concern rather than clear malicious exfiltration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Constructing a Peernet client through the browser-specific entry point.
Impact
Those services can observe the client’s public IP and, in the geolocation flow, associate it with approximate coordinates.
Mechanism
Initialization fetches the public IP from icanhazip.com; peer selection may pass it to whereis.leofcoin.org for geolocation.
AI rationale
The browser client performs an undisclosed public IP lookup automatically during initialization, with a related geolocation request used for closest-peer selection. The behavior has a plausible networking purpose, so this is a warning-level privacy concern rather than clear malicious exfiltration.
Evidence
exports/browser/node-browser-BNe-en1l.js
Network endpoints2
icanhazip.com/whereis.leofcoin.org/?ip=${address}
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Constructing the browser Peernet client calls getAddress() automatically during initialization.
- getAddress() fetches the client’s public IP from icanhazip.com.
- Peer selection can send that IP to whereis.leofcoin.org to obtain coordinates.
Evidence against
- The geolocation flow supports choosing the closest peer, a feature relevant to this peer networking package.
- The package declares no lifecycle scripts.
- The IP lookup is in the browser-specific client bundle, rather than being shown as install-time behavior.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedexports/browser/workers/machine-worker.jsView file
8562const source = instrumentContractSource(new TextDecoder().decode(decoded.contract));
L8563: const func = new Function('__lfcMeter', 'Date', 'crypto', source);
L8564: const Contract = func(meterBridge, dateBridge, cryptoBridge);
Low
Eval
Package source references a known benign dynamic code generation pattern.
exports/browser/workers/machine-worker.jsView on unpkg · L8562exports/browser/node-browser-BNe-en1l.jsView file
453* ```js
L454: * const {createHash} = await import('@leofcoin/crypto')
L455: * createHash(data, algorithm)
Medium
Dynamic Require
Package source references dynamic require/import behavior.
exports/browser/node-browser-BNe-en1l.jsView on unpkg · L453exports/browser/chain.jsView file
Findings
1 Critical2 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltaexports/browser/index.browser-CFfJpgKV.js
HighCross File Remote Execution Contextexports/browser/chain.js
HighSemantic Analysis Limitedexports/browser/index.browser-CFfJpgKV.js#virtual:normalized:round1
MediumDynamic Requireexports/browser/node-browser-BNe-en1l.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.18.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.18 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.