@neoxr/zapo@1.2.11
TypeScript connector for building WhatsApp Bot (ZapoJS)
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe entrypoint actively conceals and executes embedded code, and exits when debugging is detected. This is concrete malicious behavior rather than an inert WebAssembly carrier.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package through its declared main entrypoint.
Impact
Hidden code runs with the privileges of the importing process; its specific actions are obscured in the inspected source.
Mechanism
The entrypoint exits under debugging or inspector conditions, processes embedded data through WebAssembly, decompresses the output, and executes it with Node module access.
Attack narrative
Importing the declared entrypoint triggers anti-analysis checks and execution of JavaScript produced by an embedded WebAssembly module. The concealed code runs with the importing process's Node privileges, while its specific behavior is not visible in the inspected source.
AI rationale
The entrypoint actively conceals and executes embedded code, and exits when debugging is detected. This is concrete malicious behavior rather than an inert WebAssembly carrier.
Evidence
package.jsonlib/index.jslib/a6842418d7e3.wasm
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entrypoint is lib/index.js.
- The entrypoint exits when it detects an inspector or debugging activity.
- It loads and instantiates an embedded WebAssembly module, then uses it to process package metadata and encoded data.
- It decompresses the WebAssembly output and executes the result as JavaScript with access to Node module objects.
Evidence against
Behavioral surface
Filesystem
HighEntropyStringsMinifiedTrivial
WildcardDependency
Source & flagged code
6 flagged · loading sourcelib/a6842418d7e3.wasmView file
•path = lib/a6842418d7e3.wasm
kind = wasm_module
sizeBytes = 15891
magicHex = [redacted]
Medium
package.jsonView file
•Runtime dependency names matching Node built-ins: path
High
Node Builtin Dependency Squat
Package declares a runtime dependency whose name matches a Node built-in module.
package.jsonView on unpkg5"main": "lib/index.js",
"files": [
"lib/*"
],
"repository": {
High
Findings
5 High3 Medium2 Low
HighNode Builtin Dependency Squatpackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/index.js
HighAi Review Evidencelib/index.js
MediumShips Wasm Modulelib/a6842418d7e3.wasm
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to @neoxr/zapo@1.2.11.
See all versions of @neoxr/zapo for other recorded verdicts.
- Avoid installing @neoxr/zapo@1.2.11. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.