Loading npm security reports…

@nexaloid/nexaloid@0.1.31: Suspicious npm security report (Warn) | LPM Firewall

registry / @nexaloid/nexaloid / 0.1.31

@nexaloid/nexaloid@0.1.31

Chinese tokenizer runtime

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 6.18 KB of source

Source & flagged code

4 flagged

package.jsonView file

Lines 1-19json

2 "name": "@nexaloid/nexaloid",

3 "version": "0.1.31",

4 "description": "Chinese tokenizer runtime",

5 "license": "Apache-2.0",

6 "repository": {

7 "type": "git",

8 "url": "git+https://github.com/Nexaloid/Nexaloid.git",

9 "directory": "bindings/node"

10 },

11 "main": "index.js",

12 "scripts": {

13 "build": "node-gyp rebuild && node scripts/stage-local.js",

14 "install": "node scripts/check-prebuild.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

15 "test:binding": "node test/regression.js"

16 },

17 "gypfile": true

18}

index.jsView file

Lines 1-21javascript

1const path = require("node:path");

2const fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

prebuilds/windows-x64/nexaloid.dllView file

•path = prebuilds/windows-x64/nexaloid.dll kind = native_binary sizeBytes = 364544 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

prebuilds/windows-x64/nexaloid.dllView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 753 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.install = node scripts/check-prebuild.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code