registry / @lucideproxy/svg / 0.0.32
@lucideproxy/svg@0.0.32
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package contains a browser proxy and persistent service-worker control surface inconsistent with an SVG package. Its obfuscation and fingerprinting warrant a warning, but the inspected source does not meet the concrete-attack threshold for blocking.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user opens the bundled browser site and invokes its proxy functionality.
Impact
Proxy users may expose routed browsing traffic and cookies to the package's proxy transport; the inspected source does not establish credential exfiltration.
Mechanism
Browser service-worker proxy with cookie persistence and fingerprinting.
AI rationale
The package contains a browser proxy and persistent service-worker control surface inconsistent with an SVG package. Its obfuscation and fingerprinting warrant a warning, but the inspected source does not meet the concrete-attack threshold for blocking.
Evidence
package.jsonassets/boot-j9ZXrA22-7f2de5e0.jstpmwq3.jssc3o3/6u3hhe.jssc3o3/w3ownx.jsassets/AiPage-BUMslN5y-7f2de5e0.jsassets/fingerprint-BEH1UDAC-7f2de5e0.jsrqbm5/pnbgq4.jsrqbm5/tokgfo.wasm
Decision evidence
public snapshotAI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package is a browser proxy bundle, not an SVG library.
- Browser runtime registers a service worker and configures a proxy controller with WASM and injected worker code.
- The worker routes matching fetches and the controller persists proxy cookies in IndexedDB.
- AI-page code is deliberately obfuscated and sends a fingerprint header.
Evidence against
- package.json has no lifecycle scripts, bin, main, or exports entrypoint.
- No Node filesystem, child-process, environment harvesting, or install-time execution was found.
- No fixed credential-exfiltration endpoint or concrete payload execution chain was confirmed.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-7f2de5e0.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-7f2de5e0.jsView on unpkg · L13rqbm5/pnbgq4.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
rqbm5/pnbgq4.jsView on unpkg · L17assets/AiPage-BUMslN5y-7f2de5e0.jsView file
Findings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/AiPage-BUMslN5y-7f2de5e0.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-7f2de5e0.js
MediumSecret Patternassets/livekit-DqpdvE-G-7f2de5e0.js
MediumDynamic Requirerqbm5/pnbgq4.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulerqbm5/tokgfo.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.32.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.