@lucideproxy/svg@0.0.34
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo install-time malicious behavior was found, so a block is not justified. The browser proxy and session-cookie handling are high-risk capabilities disguised in an npm package and warrant a warning.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Serving and opening index.html, then browsing through the bundled proxy.
Impact
A user who uses the proxy may route browsing traffic and session cookies through operator-controlled infrastructure.
Mechanism
Service-worker request interception and proxy transport with proxied-session cookie handling.
AI rationale
No install-time malicious behavior was found, so a block is not justified. The browser proxy and session-cookie handling are high-risk capabilities disguised in an npm package and warrant a warning.
Evidence
package.jsonindex.htmlassets/boot-D-BNpnUk-ba5875f9.jsk70lh5.jsprivacy.htmlassets/index-BCvCIY-i-ba5875f9.jsyj86b/eopgce.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The shipped site registers a service worker that routes intercepted requests through its proxy controller.
- The service worker claims clients and handles matching fetch events, creating broad browser-session interception within its served scope.
- The included privacy page states proxied-site login cookies can be synced to the operator's servers.
- The primary application bundle is heavily obfuscated, preventing transparent verification of its runtime behavior.
Evidence against
- package.json has no lifecycle scripts or executable npm entrypoints.
- No install-time shell execution, native process access, or AI-agent configuration mutation was found.
- Proxy activation requires serving/opening the bundled web application; it is not triggered by npm installation.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourceassets/livekit-DqpdvE-G-ba5875f9.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-ba5875f9.jsView on unpkg · L13f8mmw/eg4mi0.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
f8mmw/eg4mi0.jsView on unpkg · L17assets/index-BCvCIY-i-ba5875f9.jsView file
Findings
3 High7 Medium4 Low
HighObfuscated Payload Loaderassets/index-BCvCIY-i-ba5875f9.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-ba5875f9.js
MediumSecret Patternassets/livekit-DqpdvE-G-ba5875f9.js
MediumDynamic Requiref8mmw/eg4mi0.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulef8mmw/v2bwj1.wasm
MediumOversized Source Fileassets/shaka-RjifZJiM-ba5875f9.js
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.34.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.34 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.