registry / @leofcoin/chain / 1.10.19
@leofcoin/chain@1.10.19
Official javascript implementation
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe flagged process launch and dynamic code generation are used for the local machine worker and blockchain contract runtime. The external requests support WebTransport checking and geographic peer selection; no install-time collection or unrelated account or credential actions were found.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
WebTransport probing occurs when the Node connection path loads its implementation; IP geolocation is used during closest-provider selection; contract code runs during blockchain contract deployment or execution.
Impact
These behaviors expose the connecting client IP to the relevant lookup services and execute user or chain-provided contract code within the package's contract runtime; no unrelated credential theft or attack behavior was found.
Mechanism
The package opens and closes a WebTransport test connection, looks up IP geolocation for provider selection, and executes decoded contract source in a worker.
AI rationale
The flagged process launch and dynamic code generation are used for the local machine worker and blockchain contract runtime. The external requests support WebTransport checking and geographic peer selection; no install-time collection or unrelated account or credential actions were found.
Network endpoints3
example.com:23333/testicanhazip.com/whereis.leofcoin.org/?ip=
Decision evidence
public snapshotAI called this Clean at 89.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- No preinstall, install, or postinstall hook is declared.
- The Node WebTransport implementation is loaded only when a connection needs it and the runtime lacks a WebTransport global; its probe closes the test connection.
- The worker compiles decoded blockchain contract source as part of contract deployment and execution.
- The child-process fallback forks the local machine-worker helper.
- Peer IP and geolocation lookups support choosing the closest provider.
Evidence against
- The WebTransport compatibility probe contacts https://example.com:23333/test.
- Peer selection requests the public IP from https://icanhazip.com/ and geolocation from https://whereis.leofcoin.org/?ip=.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedexports/browser/workers/machine-worker.jsView file
8562const source = instrumentContractSource(new TextDecoder().decode(decoded.contract));
L8563: const func = new Function('__lfcMeter', 'Date', 'crypto', source);
L8564: const Contract = func(meterBridge, dateBridge, cryptoBridge);
Low
Eval
Package source references a known benign dynamic code generation pattern.
exports/browser/workers/machine-worker.jsView on unpkg · L8562exports/browser/node-browser-BNe-en1l.jsView file
453* ```js
L454: * const {createHash} = await import('@leofcoin/crypto')
L455: * createHash(data, algorithm)
Medium
Dynamic Require
Package source references dynamic require/import behavior.
exports/browser/node-browser-BNe-en1l.jsView on unpkg · L453exports/browser/chain.jsView file
Findings
1 Critical2 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltaexports/browser/index.browser-CFfJpgKV.js
HighCross File Remote Execution Contextexports/browser/chain.js
HighSemantic Analysis Limitedexports/browser/index.browser-CFfJpgKV.js#virtual:normalized:round1
MediumDynamic Requireexports/browser/node-browser-BNe-en1l.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.19.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.