@lucideproxy/svg@0.0.43
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes an active browser proxy and service-worker payload, not a conventional SVG library. Its misleading packaging and session-handling capability warrant a warning, but static inspection did not prove unattended exfiltration or install-time compromise.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Opening the SVG as a document or serving the bundled web app; proxy initialization activates the service worker.
Impact
A package consumer expecting SVG assets receives a browser proxy payload with access to traffic and session cookies used through that proxy.
Mechanism
Embedded web-proxy application with service-worker request interception and cookie handling.
AI rationale
The source establishes an active browser proxy and service-worker payload, not a conventional SVG library. Its misleading packaging and session-handling capability warrant a warning, but static inspection did not prove unattended exfiltration or install-time compromise.
Evidence
index.svgassets/boot-BWLmNywq-ca3dad64.js0uux61.jsprivacy.htmlassets/index-BCu7r7Yw-ca3dad64.jswq937/7o4y9h.js
Network endpoints2
cdn.jsdelivr.net/gh/lucideproxy/svg@main/branding/lucide.pngwww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- index.svg embeds and loads a full web application, not SVG icons.
- The proxy boot module registers 0uux61.js as a service worker.
- The worker claims clients and routes selected fetches through proxy code.
- The bundled controller persists proxied-site cookies and forwards remote requests through its transport.
Evidence against
- package.json has no lifecycle scripts or Node entrypoint.
- No source evidence of install-time execution, local filesystem access, or environment-secret harvesting.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
6 flagged · loading sourceassets/livekit-DqpdvE-G-ca3dad64.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-ca3dad64.jsView on unpkg · L13m33tz/8jde3v.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
m33tz/8jde3v.jsView on unpkg · L17assets/DarkVeil-BLvPerYu-ca3dad64.jsView file
1(function(_0x23cf00,_0x32e522){const _0x22d11e={_0x81dcae:0x79,_0x20ebb4:0x247,_0x34cd18:0x22e,_0x3cd390:0x1ce,_0x15b240:0x1,_0x333f4a:0xba,_0x2c4b02:0x2c4,_0x2dfb88:0x200,_0x14887...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
assets/DarkVeil-BLvPerYu-ca3dad64.jsView on unpkg · L1m33tz/3hvgg5.wasmView file
•path = m33tz/3hvgg5.wasm
kind = wasm_module
sizeBytes = 586279
magicHex = [redacted]
Medium
assets/fingerprint-Y5nV5FVa-ca3dad64.jsView file
•matchType = normalized_sha256
matchedPackage = @lucideproxy/svg@0.0.36
matchedPath = assets/fingerprint-Y5nV5FVa-35ea9c67.js
matchedIdentity = npm:QGx1Y2lkZXByb3h5L3N2Zw:0.0.36
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
assets/fingerprint-Y5nV5FVa-ca3dad64.jsView on unpkg•matchType = malicious_source_fingerprint_signature
signature = fcf40c8ff13b7cb3
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = @lucideproxy/svg@0.0.36
matchedPath = assets/fingerprint-Y5nV5FVa-35ea9c67.js
matchedIdentity = npm:QGx1Y2lkZXByb3h5L3N2Zw:0.0.36
similarity = 1.000
shingleOverlap = 12
summary = package final verdict is malicious
High
Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
assets/fingerprint-Y5nV5FVa-ca3dad64.jsView on unpkgFindings
4 High6 Medium4 Low
HighObfuscated Payload Loaderassets/DarkVeil-BLvPerYu-ca3dad64.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-ca3dad64.js
HighKnown Malware Source Fingerprint Signatureassets/fingerprint-Y5nV5FVa-ca3dad64.js
MediumSecret Patternassets/livekit-DqpdvE-G-ca3dad64.js
MediumDynamic Requirem33tz/8jde3v.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulem33tz/3hvgg5.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.43.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.43 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.