@lucideproxy/svg@0.0.62
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source confirms a hidden browser-proxy payload with service-worker and network-routing capability, but no npm lifecycle or Node-side execution path. Treat it as an inert staged payload carrier that warrants a warning rather than an install-hook block.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A user serves or opens the shipped web application.
Impact
The application can route a user's browser traffic through its proxy service and load tracking telemetry; npm installation alone does not activate it.
Mechanism
Service-worker browser proxy with WebSocket transport and local cookie handling.
AI rationale
The source confirms a hidden browser-proxy payload with service-worker and network-routing capability, but no npm lifecycle or Node-side execution path. Treat it as an inert staged payload carrier that warrants a warning rather than an install-hook block.
Evidence
package.jsonindex.htmlassets/boot-CbSHccVV-7ac56433.jskpedq1.jsassets/proxy-runtime-1NyFshf9-7ac56433.jsassets/fingerprint-Y5nV5FVa-7ac56433.js
Network endpoints2
www.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDHm1.openfpcdn.io/fingerprintjs/v${se}/npm-monitoring
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The manifest labels this a Lucide SVG bundle, but it ships a full browser proxy application.
- Serving index.html automatically loads application and proxy scripts.
- The proxy boot code registers a service worker and configures a WebSocket transport.
- Core application files are deliberately obfuscated, concealing their runtime behavior.
- The package includes browser fingerprint monitoring and Google Analytics requests.
Evidence against
- package.json has no lifecycle scripts, dependencies, bin, or Node entrypoint.
- No install-time execution, local filesystem access, child-process use, or consumer-project mutation was found.
- The service worker is registered by browser application code, not during npm installation.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-7ac56433.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-7ac56433.jsView on unpkg · L13assets/ChatPage-CvSyyiuz-7ac56433.jsView file
1(function(_0x3bfa59,_0x67cad2){const _0x1cf21={_0x4deef9:0x2f4,_0x398e9f:0x3b4,_0x2fcb4a:0xf1,_0x1207e0:0xb8,_0x37a799:0x39c,_0x1c7d8e:0x2dc,_0x513a0a:0x71,_0x10aed8:0x15d,_0x12f26...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
assets/ChatPage-CvSyyiuz-7ac56433.jsView on unpkg · L1assets/PlusPage-Djkn9F5s-7ac56433.jsView file
1(function(_0xdbd1be,_0x2cd314){const _0x21ec3a={_0x2c453a:0x221,_0x4106d9:0x21e,_0xa4199b:0x233,_0x2ffe1b:0x20a,_0x280851:0x57,_0x31b82f:0x2d,_0x3fd4e2:0x35,_0x422129:0x1a,_0xa566f...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
assets/PlusPage-Djkn9F5s-7ac56433.jsView on unpkg · L1477xj/lexwfq.wasmView file
•path = 477xj/lexwfq.wasm
kind = wasm_module
sizeBytes = 585079
magicHex = [redacted]
Medium
assets/fingerprint-Y5nV5FVa-7ac56433.jsView file
•matchType = normalized_sha256
matchedPackage = @lucideproxy/svg@0.0.46
matchedPath = assets/fingerprint-Y5nV5FVa-30377708.js
matchedIdentity = npm:QGx1Y2lkZXByb3h5L3N2Zw:0.0.46
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
assets/fingerprint-Y5nV5FVa-7ac56433.jsView on unpkgFindings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/PlusPage-Djkn9F5s-7ac56433.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-7ac56433.js
MediumSecret Patternassets/livekit-DqpdvE-G-7ac56433.js
MediumDynamic Requireassets/ChatPage-CvSyyiuz-7ac56433.js
MediumNetwork
MediumProtestware
MediumShips Wasm Module477xj/lexwfq.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.62.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.62 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.