registry / @leofcoin/chain / 1.10.20
@leofcoin/chain@1.10.20
Official javascript implementation
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe manifest has no install hooks, and the flagged worker behavior serves chain machine processing. The unrelated WebTransport probe is guarded, and its only reviewed importer loads the module when the same global constructor is absent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Worker creation occurs during chain machine initialization; the WebTransport fallback module is imported only when a Node runtime lacks a global WebTransport constructor.
Impact
No harmful default action or viable path to the unrelated probe was identified in the reviewed code.
Mechanism
The machine helper forks the supplied worker URL in Node. The bundled WebTransport probe runs only if `globalThis.WebTransport` exists, while the client imports that bundle only when the constructor is absent.
AI rationale
The manifest has no install hooks, and the flagged worker behavior serves chain machine processing. The unrelated WebTransport probe is guarded, and its only reviewed importer loads the module when the same global constructor is absent.
Network endpoints1
example.com:23333/test
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes explicit node, chain, and browser entry points and declares no install lifecycle scripts.
- The `example.com:23333/test` WebTransport probe is guarded by the presence of a global WebTransport constructor.
- The client imports the probe-containing module only when Node lacks a global WebTransport constructor, so that import path does not satisfy the probe’s guard.
- The flagged child-process helper starts a worker at a caller-supplied URL; the chain uses it for its machine worker.
Evidence against
- The browser bundle contains a compatibility probe that attempts a WebTransport connection to `example.com:23333/test` when its global constructor is available.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkWebSocket
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
5 flaggedexports/browser/workers/machine-worker.jsView file
8562const source = instrumentContractSource(new TextDecoder().decode(decoded.contract));
L8563: const func = new Function('__lfcMeter', 'Date', 'crypto', source);
L8564: const Contract = func(meterBridge, dateBridge, cryptoBridge);
Low
Eval
Package source references a known benign dynamic code generation pattern.
exports/browser/workers/machine-worker.jsView on unpkg · L8562exports/browser/node-browser-Ha4Lvntj.jsView file
453* ```js
L454: * const {createHash} = await import('@leofcoin/crypto')
L455: * createHash(data, algorithm)
Medium
Dynamic Require
Package source references dynamic require/import behavior.
exports/browser/node-browser-Ha4Lvntj.jsView on unpkg · L453exports/browser/chain.jsView file
Findings
1 Critical2 High3 Medium6 Low
CriticalPrevious Version Dangerous Deltaexports/browser/index.browser-CFfJpgKV.js
HighCross File Remote Execution Contextexports/browser/chain.js
HighSemantic Analysis Limitedexports/browser/index.browser-CFfJpgKV.js#virtual:normalized:round1
MediumDynamic Requireexports/browser/node-browser-Ha4Lvntj.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEvalexports/browser/workers/machine-worker.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
LowUrl Strings
Affected versions and remediation
This report applies to @leofcoin/chain@1.10.20.
See all versions of @leofcoin/chain for other recorded verdicts.
- Review the evidence and your use of @leofcoin/chain@1.10.20 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.