@lucideproxy/svg@0.0.71
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a browser proxy and hidden credentialed fetch, but not an install hook, host-specific theft, or destructive action. The package should be warned as a dangerous opaque capability rather than blocked as confirmed malware.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
Serving and opening index.html or index.svg in a browser.
Impact
The site can proxy browser traffic and handle cookies for proxied sessions; the hidden remote fetch makes its runtime behavior difficult to audit.
Mechanism
Service-worker request interception, cookie handling, and obfuscated remote fetching.
AI rationale
The source establishes a browser proxy and hidden credentialed fetch, but not an install hook, host-specific theft, or destructive action. The package should be warned as a dangerous opaque capability rather than blocked as confirmed malware.
Evidence
index.htmlgi8lc3.js0bvvq/eikmz1.jsassets/GamesPage-o1w5rBwK-22cfa718.js8fmvz/lelug2.js8fmvz/oxydxk.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The package is a complete browser proxy application rather than an SVG-only asset package.
- Its service worker claims clients and routes intercepted requests through proxy code.
- The Games page is deliberately obfuscated and resolves a hidden URL before fetching it with browser credentials.
- The proxy runtime manages cookies and rewrites browser requests, including WebSocket traffic.
Evidence against
- package.json has no lifecycle scripts, dependencies, or Node entry point.
- No install-time execution, local file harvesting, shell use, or consumer-project mutation was found.
- The risky behavior runs only when the included static site is served and opened in a browser.
- No fixed hostile endpoint or confirmed secret exfiltration was recoverable from the inspected source.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
5 flagged · loading sourceassets/livekit-DqpdvE-G-22cfa718.jsView file
13patternName = generic_password
severity = medium
line = 13
matchedText = `},e.par...+`\r
Medium
Secret Pattern
Package contains a possible secret pattern.
assets/livekit-DqpdvE-G-22cfa718.jsView on unpkg · L130bvvq/eikmz1.jsView file
17L18: //# sourceURL=${A}`)();n=c,s=l}else n=g.z$,s=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,o=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{o=!0,n=e},call:()=>(o=!0,n=s(...
L19: //# sourceURL=${r.url.href}`),n}return s.body;case"style":return(0,i.sM)(await s.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await s.arra...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
0bvvq/eikmz1.jsView on unpkg · L17assets/GamesPage-o1w5rBwK-22cfa718.jsView file
1(function(_0x356689,_0x4d4d81){const _0x3ce2b9={_0x1ce6c1:0x3a4,_0x371bbb:0x3de,_0x4ea148:0x3e1,_0x4dfc60:0x47a,_0x158b13:0x48d,_0x1d11fa:0x479,_0x33026c:0x3dd,_0x1e9691:0x435,_0x4...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
assets/GamesPage-o1w5rBwK-22cfa718.jsView on unpkg · L10bvvq/xk287w.wasmView file
•path = 0bvvq/xk287w.wasm
kind = wasm_module
sizeBytes = 585079
magicHex = [redacted]
Medium
assets/fingerprint-Y5nV5FVa-22cfa718.jsView file
•matchType = normalized_sha256
matchedPackage = @lucideproxy/svg@0.0.65
matchedPath = assets/fingerprint-Y5nV5FVa-210c06f6.js
matchedIdentity = npm:QGx1Y2lkZXByb3h5L3N2Zw:0.0.65
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
assets/fingerprint-Y5nV5FVa-22cfa718.jsView on unpkgFindings
3 High6 Medium4 Low
HighObfuscated Payload Loaderassets/GamesPage-o1w5rBwK-22cfa718.js
HighObfuscated
HighKnown Malware Source Similarityassets/fingerprint-Y5nV5FVa-22cfa718.js
MediumSecret Patternassets/livekit-DqpdvE-G-22cfa718.js
MediumDynamic Require0bvvq/eikmz1.js
MediumNetwork
MediumProtestware
MediumShips Wasm Module0bvvq/xk287w.wasm
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @lucideproxy/svg@0.0.71.
See all versions of @lucideproxy/svg for other recorded verdicts.
- Review the evidence and your use of @lucideproxy/svg@0.0.71 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.