registry / @smartledger/bsv / 6.2.1

@smartledger/bsv@6.2.1

🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based crede

AI Security Review

scanned 18h ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Installation does not run package code, and import-time code does not harvest credentials, execute shells, or contact a network endpoint.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit CLI commands or explicit use of development storage APIs.

Impact

Creates caller-requested local files only; no exfiltration, stealth persistence, or foreign control-surface mutation found.

Mechanism

User-invoked local DID/key generation and development-state persistence.

Rationale

The malicious scanner signals are not corroborated by source: the lifecycle hook is publish-only, the binary blob is a test fixture, and minified eval matches bundled dependency/math/polyfill code rather than a hidden payload loader. Source inspection found only explicit user-command local writes and no concrete malicious chain.

Evidence

package.jsonindex.jsbin/cli.jsbuild/esbuild.jslib/smartutxo.jslib/smart_contract/covenant.jstest/block/block.jstest/data/blk86756-testnet.dat

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with high false-positive risk.

Evidence for block

Evidence against

package.json contains only prepublishOnly; no install, preinstall, postinstall, or prepare hook.
index.js imports library modules and exposes SmartUTXO lazily; no import-time network or shell execution found.
bin/cli.js writes DID/key files only for explicit CLI subcommands and paths under the caller's cwd.
lib/smartutxo.js and lib/smart_contract/covenant.js implement documented local development state storage.
No runtime child_process or direct HTTP/HTTPS/network-client use was found in source modules.
test/data/blk86756-testnet.dat is referenced only by block parsing tests; its bytes match a blockchain fixture.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNativeBindings

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 165 file(s), 9.18 MB of source, external domains: bsv.io, docs.moneybutton.com, github.com, smartledger.technology, w3id.org, www.w3.org

Source & flagged code

6 flagged

bsv-statuslist.min.jsView file

Lines 1-30javascript

1var bsvStatusList=(()=>{var HE=Object.create;var Y0=Object.defineProperty;var WE=Object.getOwnPropertyDescriptor;var KE=Object.getOwnPropertyNames;var GE=Object.getPrototypeOf,VE=Object.prototype.hasOwnProperty;var $E=(e,t,r)=>()=>{if(r)throw r[0];try{return e&&(t=e(e=0)),t}catch(i){throw r=[i],i}};var R=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(r){throw t=0,r}};var YE=(e,t,r,i)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of KE(t))!VE.call(e,n)&&n!==r&&Y0(e,n,{get:()=>t[n],enumerable:!(i=WE(t,n))||i.enumerable});return e};var J0=(e,t,r)=>(r=e!=null? ...

2Use Chrome, Firefox or Internet Explorer 11`)}var q6=De().Buffer,yf=globalThis.crypto||globalThis.msCrypto;yf&&yf.getRandomValues?sl.exports=D6:sl.exports=O6;function D6(e,t){if(e>I6)throw new RangeError("requested too many random bytes");var r=q6.allocUnsafe(e);if(e>0)if(e>fl)for(var i=0;i<e;i+=fl)yf.getRandomValues(r.slice(i,i+fl));else yf.getRandomValues(r);return typeof t=="function"?M.default.nextTick(function(){t(null,r)}):r}});var Ke=R((XO,ul)=>{m();typeof Object.create=="function"?ul.exports=function(t,r){t.super_=r,t.prototype=Object.create(r.prototype,{constructor:{value:t,enumerable ...

3`)>-1&&(a?s=s.split(`

4`).map(function(_){return" "+_}).join(`

5`).slice(2):s=`

6`+s.split(`

7`).map(function(_){return" "+_}).join(`

8`))):s=e.stylize("[Circular]","special")),Ui(o)){if(a&&n.match(/^\d+$/))return s;o=JSON.stringify(""+n),o.match(/^"([a-zA-Z_][a-zA-Z_0-9]*)"$/)?(o=o.slice(1,-1),o=e.stylize(o,"name")):(o=

9`)>=0&&i++,a+o.replace(/\u001b\[\d\d?m/g,"").length+1},0);return n>60?r[0]+(t===""?"":t+`

10 `)+" "+e.join(`,

11 `)+" "+r[1]:r[0]+t+" "+e.join(", ")+" "+r[1]}Ue.types=ny();function uy(e){return Array.isArray(e)}Ue.isArray=uy;function Zl(e){return

12 this._initNamed(entity);

Low

Eval

Package source references a known benign dynamic code generation pattern.

bsv-statuslist.min.jsView on unpkg · L10

13})`)}catch{r=function(n){this._initNamed(n)}}return $R(r,t),r.prototype._initNamed=function(n){t.call(this,n)},new r(this)};oa.prototype._getDecoder=function(t){return t=t||"der",this.decoders.hasOwnProperty(t)||(this.decoders[t]=this._createNamed(Z_.decoders[t])),this.decoders[t]};oa.prototype.decode=function(t,r,i){return this._getDecoder(r).decode(t,i)};oa.prototype._getEncoder=function(t){return t=t||"der",this.encoders.hasOwnProperty(t)||(this.encoders[t]=this._createNamed(Z_.encoders[t])),this.encoders[t]};oa.prototype.encode=function(t,r,i){return this._getEncoder(r).encode(t,i)}});var ...

14`)}});var _m=R(bm=>{m();var gm=bm;gm.der=Fc();gm.pem=ym()});var fa=R(mm=>{m();var la=mm;la.bignum=ei();la.define=W_().define;la.base=ua();la.constants=qc();la.decoders=lm();la.encoders

15use chrome, FireFox or Internet Explorer 11`)}var Qm=De(),Xm=qi(),ew=Qm.Buffer,tw=Qm.kMaxLength,e0=globalThis.crypto||globalThis.msCrypto,rw=Math.pow(2,32)-1;function iw(e,t){if(typeof e!="number"||e!==e)throw new TypeError("offset must be a number");if(e>rw||e<0)throw new TypeError("offset must be a uint32");if(e>tw||e>t)throw new RangeError("offset out of range")}function nw(e,t,r){if(typeof e!="number"||e!==e)throw new TypeError("size must be a number");if(e>rw||e<0)throw new TypeError("size must be a uint32");if(e+t>r||e>tw)throw new RangeError("buffer too small")}e0&&e0.getRandomValues||! ...

16we accept pull requests

17https://github.com/browserify/crypto-browserify`)};Ne.constants={DH_CHECK_P_NOT_SAFE_PRIME:2,DH_CHECK_P_NOT_PRIME:1,DH_UNABLE_TO_CHECK_GENERATOR:4,DH_NOT_SUITABLE_GENERATOR:8,NPN_ENABLED:1,ALPN_ENABLED:1,RSA_PKCS1_PADDING:1,RSA_SSLV23_PADDING:2,RSA_NO_PADDING:3,RSA_PKCS1_OAEP_PADDING:4,RSA_X931_PADDING:5,RSA_PKCS1_PSS_PADDING:6,POINT_CONVERSION_COMPRESSED:2,POINT_CONVERSION_UNCOMPRESSED:4,POINT_CONVERSION_HYBRID:6}});var lw=R((WC,uw)=>{"use strict"

18`),x=jo(t).split(`

19`),B=0,k="";if(r==="strictEqual"&&Mt(e)==="object"&&Mt(t)==="object"&&e!==null&&t!==null&&(r="strictEqualObject"),_.length===1&&x.length===1&&_[0]!==x[0]){var T=_[0].length+x[0].length;if(T<=LT){if((Mt(e)!=="object"||e===null)&&(Mt(t)!=="object"||t===null)&&(e!==0||t!==0))return"".concat(sn[r],`

21`)+"".concat(_[0]," !== ").concat(x[0],`

22`)}else if(r!=="strictEqualObject"){var O=M.default.stderr&&M.default.stderr.isTTY?M.default.stderr.columns:80;if(T<O){for(;_[0][B]===x[0][B];)B++;B>2&&(k=`

23 `.concat(PT(" ",B),"^"),B=0)}}}for(var D=_[_.length-1],U=x[x.length-1];D===U&&(B++<2?o=`

24 `.concat(D).concat(o):i=D,_.pop(),x.pop(),!(_.length===0||x.length===0));)D=_[_.length-1],U=x[x.length-1];var N=Math.max(_.length,x.length);if(N===0){var j=y.split(`

25`);if(j.length>30)for(j[26]="".concat(ir,"...").concat(lt);j.length>27;)j.pop();return"".concat(sn.notIdentical,`

27`).concat(j.join(`

28`),`

29`)}B>3&&(o=`

30`.concat(ir,"...").concat(lt).concat(o),s=!0),i!==""&&(o=`

Long lines were clipped for display.

lib/crypto/hash.node.jsView file

Lines 1-31javascript

1'use strict'

3var crypto = require('crypto')

4var $ = require('../util/preconditions')

6var Hash = module.exports

8/**

bsv-smartcontract.min.jsView file

Lines 1-21javascript

test/data/blk86756-testnet.datView file

•path = test/data/blk86756-testnet.dat kind = high_entropy_blob sizeBytes = 9500 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/data/blk86756-testnet.datView on unpkg

•path = test/data/blk86756-testnet.dat kind = payload_in_excluded_dir sizeBytes = 9500 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/data/blk86756-testnet.datView on unpkg

build/esbuild.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @smartledger/bsv@6.1.0 matchedIdentity = npm:QHNtYXJ0bGVkZ2VyL2Jzdg:6.1.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/esbuild.jsView on unpkg

Source & flagged code

6 flagged · loading source

bsv-statuslist.min.jsView file

10`)+" "+e.join(`, L11: `)+" "+r[1]:r[0]+t+" "+e.join(", ")+" "+r[1]}Ue.types=ny();function uy(e){return Array.isArray(e)}Ue.isArray=uy;function Zl(e){return typeof e=="boolean"}Ue.isBoolean=Zl;function $... L12: this._initNamed(entity);

Low

Eval

Package source references a known benign dynamic code generation pattern.

bsv-statuslist.min.jsView on unpkg · L10

lib/crypto/hash.node.jsView file

11* See: L12: * https://en.wikipedia.org/wiki/SHA-1 L13: *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/crypto/hash.node.jsView on unpkg · L11

bsv-smartcontract.min.jsView file

1var bsvSmartContract=(()=>{var xh=Object.create;var kn=Object.defineProperty;var yh=Object.getOwnPropertyDescriptor;var wh=Object.getOwnPropertyNames;var bh=Object.getPrototypeOf,S... L2: `)};ct.prototype._generateLeftExtractionASM=function(t,e){var r=[{name:"nVersion",len:4,offset:0},{name:"hashPrevouts",len:32,offset:4},{name:"hashSequence",len:32,offset:36},{name... ... L4: `)};ct.prototype._generateScriptLenExtractionASM=function(t,e){return["# \u{1F3AF} Extract scriptLen CompactSize varint ("+t.scriptLenSize+" bytes)","104 OP_SPLIT # Skip... L5: `)};ct.prototype._extractSpecificField=function(t,e){var r=e[t];return r?E.Buffer.from(r,"hex"):null};ct.prototype._interpretField=function(t,e,r){if(!e)return null;var n={raw:e.to... L6: `),Object.keys(t.wallets).length>0&&(Bt("\u{1F45B} Registered Wallets:"),Object.entries(t.wallets).forEach(([e,r])=>{Bt(` ${e}: ${r.utxos.length} UTXOs, ${r.totalValue} sats`)})),... ... L16: \u{1F9E9} Step ${A+1}: ${Te.Opcode.reverseMap[O.opcodenum]||"PUSH"}`),console.log("Stack:",Ln(x.stack)),console.log("AltStack:",Ln(x.altstack))}catch(T){console.log(`\u26A0\uFE0F E... L17: ===========================================`),console.log(

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bsv-smartcontract.min.jsView on unpkg · L1

test/data/blk86756-testnet.datView file

•path = test/data/blk86756-testnet.dat kind = high_entropy_blob sizeBytes = 9500 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/data/blk86756-testnet.datView on unpkg

•path = test/data/blk86756-testnet.dat kind = payload_in_excluded_dir sizeBytes = 9500 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/data/blk86756-testnet.datView on unpkg

build/esbuild.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/esbuild.jsView on unpkg

Findings

1 Critical4 High3 Medium8 Low

CriticalPrevious Version Dangerous Deltabuild/esbuild.js

HighObfuscated Payload Loaderbsv-smartcontract.min.js

HighObfuscated

HighShips High Entropy Blobtest/data/blk86756-testnet.dat

HighPayload In Excluded Dirtest/data/blk86756-testnet.dat

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalbsv-statuslist.min.js

LowWeak Cryptolib/crypto/hash.node.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

bsv-statuslist.min.jsView file

Lines 1-30javascript

3`)>-1&&(a?s=s.split(`

4`).map(function(_){return" "+_}).join(`

5`).slice(2):s=`

6`+s.split(`

7`).map(function(_){return" "+_}).join(`

8`))):s=e.stylize("[Circular]","special")),Ui(o)){if(a&&n.match(/^\d+$/))return s;o=JSON.stringify(""+n),o.match(/^"([a-zA-Z_][a-zA-Z_0-9]*)"$/)?(o=o.slice(1,-1),o=e.stylize(o,"name")):(o=

9`)>=0&&i++,a+o.replace(/\u001b\[\d\d?m/g,"").length+1},0);return n>60?r[0]+(t===""?"":t+`

10 `)+" "+e.join(`,

11 `)+" "+r[1]:r[0]+t+" "+e.join(", ")+" "+r[1]}Ue.types=ny();function uy(e){return Array.isArray(e)}Ue.isArray=uy;function Zl(e){return

12 this._initNamed(entity);

Low

Eval

Package source references a known benign dynamic code generation pattern.

bsv-statuslist.min.jsView on unpkg · L10

14`)}});var _m=R(bm=>{m();var gm=bm;gm.der=Fc();gm.pem=ym()});var fa=R(mm=>{m();var la=mm;la.bignum=ei();la.define=W_().define;la.base=ua();la.constants=qc();la.decoders=lm();la.encoders

16we accept pull requests

18`),x=jo(t).split(`

21`)+"".concat(_[0]," !== ").concat(x[0],`

22`)}else if(r!=="strictEqualObject"){var O=M.default.stderr&&M.default.stderr.isTTY?M.default.stderr.columns:80;if(T<O){for(;_[0][B]===x[0][B];)B++;B>2&&(k=`

23 `.concat(PT(" ",B),"^"),B=0)}}}for(var D=_[_.length-1],U=x[x.length-1];D===U&&(B++<2?o=`

24 `.concat(D).concat(o):i=D,_.pop(),x.pop(),!(_.length===0||x.length===0));)D=_[_.length-1],U=x[x.length-1];var N=Math.max(_.length,x.length);if(N===0){var j=y.split(`

25`);if(j.length>30)for(j[26]="".concat(ir,"...").concat(lt);j.length>27;)j.pop();return"".concat(sn.notIdentical,`

27`).concat(j.join(`

28`),`

29`)}B>3&&(o=`

30`.concat(ir,"...").concat(lt).concat(o),s=!0),i!==""&&(o=`

Long lines were clipped for display.

lib/crypto/hash.node.jsView file

Lines 1-31javascript

1'use strict'

3var crypto = require('crypto')

4var $ = require('../util/preconditions')

6var Hash = module.exports

8/**

bsv-smartcontract.min.jsView file

Lines 1-21javascript

test/data/blk86756-testnet.datView file

•path = test/data/blk86756-testnet.dat kind = high_entropy_blob sizeBytes = 9500 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/data/blk86756-testnet.datView on unpkg

•path = test/data/blk86756-testnet.dat kind = payload_in_excluded_dir sizeBytes = 9500 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/data/blk86756-testnet.datView on unpkg

build/esbuild.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/esbuild.jsView on unpkg