registry / @lucideproxy/svg / 0.0.49
@lucideproxy/svg@0.0.49
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a disguised, obfuscated browser-proxy application distributed as an SVG package, creating a real dangerous capability on render. The source does not establish the concrete malicious behaviors required for a publication block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer opens or renders index.svg in a script-capable browser context.
Impact
Provides concealed browser-proxy capability outside the expected scope of an SVG package.
Mechanism
automatic loading of an obfuscated service-worker/WebSocket proxy application
AI rationale
This is a disguised, obfuscated browser-proxy application distributed as an SVG package, creating a real dangerous capability on render. The source does not establish the concrete malicious behaviors required for a publication block.
Evidence
package.jsonindex.svghwo0p/wbnscw.jsassets/proxy-runtime-1NyFshf9-eba7ed1b.jsassets/AccountPage-D8BKYGd9-eba7ed1b.js9wgk8/9bzja7.jsassets/index-DbeAKJxK-eba7ed1b.js
Network endpoints1
www.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Manifest describes a proxy-site bundle, not a normal SVG library.
- Opening index.svg automatically loads two scripts and dynamically imports a large app bundle.
- The bundled runtime manages a service-worker controller and cookie synchronization.
- The proxy runtime supports WebSocket proxy transport and arbitrary proxy settings.
- Most application bundles are deliberately string-obfuscated, concealing runtime routes and requests.
Evidence against
- No npm lifecycle scripts, bin, main, or module entrypoints are declared.
- No Node child-process, filesystem, environment harvesting, eval, or Function execution was found.
- No concrete credential exfiltration or destructive install-time behavior was established.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestware
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-eba7ed1b.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-eba7ed1b.jsView on unpkg · L139wgk8/9bzja7.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
9wgk8/9bzja7.jsView on unpkg · L17assets/AccountPage-D8BKYGd9-eba7ed1b.jsView file
Findings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/AccountPage-D8BKYGd9-eba7ed1b.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-eba7ed1b.js
MediumSecret Patternassets/livekit-DqpdvE-G-eba7ed1b.js
MediumDynamic Require9wgk8/9bzja7.js
MediumNetwork
MediumProtestware
MediumShips Wasm Module9wgk8/9dvb3v.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.49.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.49 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.