registry / @levo-so/next-middleware / 0.3.34
@levo-so/next-middleware@0.3.34
Next middleware to add a proxy for levo integration in apps
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe inspected source matches the package's stated Next.js proxy purpose: matching requests are rewritten to Levo API hosts, while the helper exports parse supplied data. No install hooks or unrelated network behavior were found.
Static reason
No blocking static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
The middleware runs when integrated into a Next.js app and receives a request for a configured proxy or SEO file path.
Impact
Expected proxy behavior for the package's stated purpose; no unrelated collection, account action, persistence, or destructive behavior was found.
Mechanism
It rewrites matching requests to the configured Levo API endpoints, forwarding request headers; exported helpers parse visitor and location data from supplied values.
AI rationale
The inspected source matches the package's stated Next.js proxy purpose: matching requests are rewritten to Levo API hosts, while the helper exports parse supplied data. No install hooks or unrelated network behavior were found.
Network endpoints2
public-api.levo.soinsights-api.levo.so
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package entry point is dist/index.js, and the manifest declares sideEffects false.
- The middleware defaults to the documented Levo API hosts and rewrites matching Levo API paths to those services.
- The GeoIP export extracts country and language data from supplied headers; it does not make network requests.
- The declared npm scripts are build, type checking, cleanup, and development watch commands.
Evidence against
Behavioral surface
EnvironmentVars
UrlStrings
NoLicense
Source & flagged code
6 flaggeddist/index.jsView file
•matchType = malicious_source_fingerprint_signature
signature = 55ba53f9f3da81cc
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @levo-so/next-middleware@0.3.32
matchedPath = dist/index.js
matchedIdentity = npm:[redacted]:0.3.32
similarity = 1.000
shingleOverlap = 1
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.jsView on unpkg12const { apiUrl = "https://public-api.levo.so", insightsUrl = "https://insights-api.levo.so", fileExclusions = [], } = options;
const { nextUrl } = request;
const { pathname, search, hash } = nextUrl;
const host = request.headers.get("host");
const workspace = request.headers.get("Levo-Workspace");
// Clone the original request headers
const modified_headers = new Headers(request.headers);
if (host) {
// Tra
Low
Ai Review Evidence
The middleware defaults to the documented Levo API hosts and rewrites matching Levo API paths to those services.
dist/index.jsView on unpkg · L1231}
if (host && pathname.startsWith("/.levo/public/api")) {
const targetPath = pathname.replace(/^\/.levo\/public\/api/, "");
const workspaceQuery = workspace && !search.includes("workspace=")
? `${search ? "&" : "?"}workspace=${workspace}`
: "";
const targetURL = `${apiUrl}${targetPath}${search}${workspaceQuery}${hash}`;
// SSE endpoints must opt out of Next.js's gzip layer when running under
// `next dev`. Dev mode buffers ~16KB before flushing
Findings
1 High1 Medium8 Low
HighKnown Malware Source Fingerprint Signaturedist/index.js
MediumEnvironment Vars
LowScripts Present
LowUrl Strings
LowNo License
LowAi Review Evidencepackage.json
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/index.js
LowAi Review Evidencedist/geoIp.js
LowAi Review Evidencepackage.json
Affected versions and remediation
This report applies to @levo-so/next-middleware@0.3.34.
See all versions of @levo-so/next-middleware for other recorded verdicts.
- Review the evidence and your use of @levo-so/next-middleware@0.3.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.