registry / @lucideproxy/svg / 0.0.59
@lucideproxy/svg@0.0.59
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe artifact is not an SVG library and exposes an obfuscated proxy/cookie-control surface at browser runtime. Its lack of npm lifecycle or import entrypoints prevents a publish block under the concrete-attack threshold.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user renders or serves index.svg/index.html.
Impact
Can proxy browser traffic and handle cookies for proxied sessions; no concrete exfiltration recipient was confirmed.
Mechanism
Browser URL-rewriting proxy with cookie bridging and fingerprinted fetches.
AI rationale
The artifact is not an SVG library and exposes an obfuscated proxy/cookie-control surface at browser runtime. Its lack of npm lifecycle or import entrypoints prevents a publish block under the concrete-attack threshold.
Evidence
package.jsonindex.svgm94p9/xfbdnk.jsassets/index-DN2zlKsu-59094c2b.jsassets/AiPage-BnBgcdyY-59094c2b.jsbyvmk/dlx7e0.jsm94p9/mriajm.js
Network endpoints2
cdn.jsdelivr.net/gh/lucideproxy/svg@main/branding/lucide.pngwww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Rendering index.svg auto-loads the bundled proxy and app scripts.
- The service-worker bridge transfers cookies into a proxy client.
- The main browser bundle is deliberately obfuscated and uses new Function.
- AiPage sends a generated fingerprint header in fetch requests.
Evidence against
- package.json has no lifecycle scripts, bin, main, or module entrypoint.
- No confirmed credential theft, filesystem access, shell execution, or malicious endpoint was recoverable from source.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-59094c2b.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-59094c2b.jsView on unpkg · L13byvmk/dlx7e0.jsView file
17L18: //# sourceURL=${A}`)();n=c,s=l}else n=g.z$,s=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,o=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{o=!0,n=e},call:()=>(o=!0,n=s(...
L19: //# sourceURL=${r.url.href}`),n}return s.body;case"style":return(0,i.sM)(await s.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await s.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
byvmk/dlx7e0.jsView on unpkg · L17assets/AiPage-BnBgcdyY-59094c2b.jsView file
1(function(_0x344034,_0x380930){const _0x5764f4={_0x85e203:0x212,_0x2064be:0x29b,_0x40430a:0x1ce,_0x55545b:0x176,_0x43791a:0x1cd,_0x4627ef:0xac,_0x1eadfe:0x4d8,_0xd094dc:0x7bc,_0x86...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
assets/AiPage-BnBgcdyY-59094c2b.jsView on unpkg · L1byvmk/n1iobj.wasmView file
•path = byvmk/n1iobj.wasm
kind = wasm_module
sizeBytes = 585079
magicHex = [redacted]
Medium
assets/fingerprint-Y5nV5FVa-59094c2b.jsView file
•matchType = normalized_sha256
matchedPackage = @lucideproxy/svg@0.0.46
matchedPath = assets/fingerprint-Y5nV5FVa-30377708.js
matchedIdentity = npm:QGx1Y2lkZXByb3h5L3N2Zw:0.0.46
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
assets/fingerprint-Y5nV5FVa-59094c2b.jsView on unpkgFindings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/AiPage-BnBgcdyY-59094c2b.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-59094c2b.js
MediumSecret Patternassets/livekit-DqpdvE-G-59094c2b.js
MediumDynamic Requirebyvmk/dlx7e0.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebyvmk/n1iobj.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.59.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.59 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.