registry / @lucideproxy/svg / 0.0.18

@lucideproxy/svg@0.0.18

Lucide SVG build: static proxy site bundle served from index.svg

AI Security Review

scanned 1d ago · by lpm-firewall-ai

Rendering index.svg imports an obfuscated bundle that retrieves a dynamically constructed resource and executes decoded content. This permits remote code execution in the viewer's browser context.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

A user or application renders or opens index.svg/index.html.

Impact

Arbitrary remote JavaScript can run in the page origin and access browser-available data and capabilities.

Mechanism

Obfuscated remote payload fetch followed by dynamic Function execution.

Attack narrative

Opening the shipped SVG loads the obfuscated main bundle. That bundle fetches a dynamically constructed resource and passes decoded content to new Function for execution, allowing the publisher to change executed browser code remotely without changing the package artifact.

Rationale

This is a concrete runtime remote-code-execution loader embedded in an ostensibly SVG package. Lack of install hooks does not mitigate the browser execution path.

Evidence

index.svgassets/index-Dovlogfo-72615aea.jspackage.json

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

@lucideproxy/svg@0.0.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code