registry / @lucideproxy/svg / 0.0.58
@lucideproxy/svg@0.0.58
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete install-time malware or unconsented host mutation was found. The shipped, obfuscated browser proxy and service-worker interception capability warrants a warning.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user opens or deploys index.html/index.svg and initializes the bundled site.
Impact
Routed browsing traffic and associated cookies may be handled by the proxy application.
Mechanism
Service-worker interception backed by a WebSocket HTTPS proxy runtime.
AI rationale
No concrete install-time malware or unconsented host mutation was found. The shipped, obfuscated browser proxy and service-worker interception capability warrants a warning.
Evidence
package.jsonindex.htmlassets/boot-BWpQhGL6-fd123df0.jsq1cecm.js7etg5/ojie3s.jsassets/proxy-runtime-1NyFshf9-fd123df0.js
Network endpoints1
www.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Opening the bundled site registers a service worker.
- The service worker claims clients and routes qualifying fetches through a proxy handler.
- The runtime provides a WebSocket-backed HTTPS proxy transport.
- The page imports heavily obfuscated proxy/runtime bundles and Google Analytics.
Evidence against
- package.json has no lifecycle scripts or Node entrypoint.
- The manifest describes this as a static proxy-site bundle, matching the observed browser proxy components.
- No install-time execution, host-file access, credential harvesting, or native process execution was found.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-fd123df0.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-fd123df0.jsView on unpkg · L13z305d/y31hvo.jsView file
17L18: //# sourceURL=${A}`)();n=c,s=l}else n=g.z$,s=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,o=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{o=!0,n=e},call:()=>(o=!0,n=s(...
L19: //# sourceURL=${r.url.href}`),n}return s.body;case"style":return(0,i.sM)(await s.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await s.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
z305d/y31hvo.jsView on unpkg · L17assets/AccountPage-DmKLAz91-fd123df0.jsView file
Findings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/AccountPage-DmKLAz91-fd123df0.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-fd123df0.js
MediumSecret Patternassets/livekit-DqpdvE-G-fd123df0.js
MediumDynamic Requirez305d/y31hvo.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulez305d/c4qexr.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.58.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.58 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.