registry / @lucideproxy/svg / 0.0.33
@lucideproxy/svg@0.0.33
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a real, user-invoked proxy capability with broad browser request routing, but no concrete npm-install malware or unconsented credential theft was found. This warrants a warning for dangerous capability rather than a publish block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user opens the bundled site and starts its proxy controller.
Impact
User web traffic routed through the proxy may include proxied-site session data.
Mechanism
Service-worker-based web request proxying.
AI rationale
The source establishes a real, user-invoked proxy capability with broad browser request routing, but no concrete npm-install malware or unconsented credential theft was found. This warrants a warning for dangerous capability rather than a publish block.
Evidence
package.jsonindex.svg8okmaa.jsassets/boot-BZOZraLD-562ef6f6.jsassets/proxy-runtime-1NyFshf9-562ef6f6.js
Network endpoints2
cdn.jsdelivr.net/gh/lucideproxy/svg@main/branding/lucide.pngwww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package is a browser proxy bundle, not an SVG library.
- Its service worker claims clients and routes qualifying fetches through bundled proxy code.
- The runtime registers that service worker when the proxy controller is started.
Evidence against
- package.json has no lifecycle scripts or Node entrypoints.
- No install-time execution, shell/process access, or local file harvesting was found in inspected sources.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourceassets/livekit-DqpdvE-G-562ef6f6.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-562ef6f6.jsView on unpkg · L13tikfx/pbsqmp.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
tikfx/pbsqmp.jsView on unpkg · L17assets/GamesPage-CcHtzAff-562ef6f6.jsView file
Findings
3 High7 Medium4 Low
HighObfuscated Payload Loaderassets/GamesPage-CcHtzAff-562ef6f6.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-562ef6f6.js
MediumSecret Patternassets/livekit-DqpdvE-G-562ef6f6.js
MediumDynamic Requiretikfx/pbsqmp.js
MediumNetwork
MediumProtestware
MediumShips Wasm Moduletikfx/6bdz12.wasm
MediumOversized Source Fileassets/shaka-RjifZJiM-562ef6f6.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.33.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.33 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.