@lucideproxy/svg@0.0.40
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe capability is real and deceptively packaged, but activation is runtime/user-driven and the inspected source did not prove a concrete theft or install-time attack chain. Warn rather than block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Serving/opening the bundled site and initializing its proxy feature.
Impact
Proxied browser requests, including session-bearing requests, can be relayed through the site-controlled proxy path.
Mechanism
Service-worker browser traffic interception with an embedded Wisp proxy transport.
AI rationale
The capability is real and deceptively packaged, but activation is runtime/user-driven and the inspected source did not prove a concrete theft or install-time attack chain. Warn rather than block.
Evidence
package.jsonassets/boot-Cr0E_DtR-49837e9a.jstmuoeb.jsassets/index-CGGugypL-49837e9a.jszn6zi/3in2q2.js
Network endpoints1
/fairs/
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Manifest describes a static proxy site bundle, not an SVG library.
- Proxy bootstrap registers a service worker and configures a Wisp transport at /fairs/.
- Service worker claims clients and routes proxied fetches through its controller.
- Obfuscated main bundle dynamically invokes new Function on concealed values.
Evidence against
- No preinstall, install, postinstall, bin, or Node entrypoint is declared.
- No explicit off-package exfiltration endpoint or credential-stealing routine was confirmed by source inspection.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourceassets/livekit-DqpdvE-G-49837e9a.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-49837e9a.jsView on unpkg · L13her6g/6ptbzk.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
her6g/6ptbzk.jsView on unpkg · L17assets/SettingsPage-CtzOLf0B-49837e9a.jsView file
Findings
4 High6 Medium4 Low
HighObfuscated Payload Loaderassets/SettingsPage-CtzOLf0B-49837e9a.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-49837e9a.js
HighKnown Malware Source Fingerprint Signatureassets/fingerprint-Y5nV5FVa-49837e9a.js
MediumSecret Patternassets/livekit-DqpdvE-G-49837e9a.js
MediumDynamic Requireher6g/6ptbzk.js
MediumNetwork
MediumProtestware
MediumShips Wasm Moduleher6g/ddh44q.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.40.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.40 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.