@testsecuiitytestme/cache-helper@1.0.1
Cache helper utilities
AI Security Review
scanned 8d ago · by lpm-firewall-aiSource inspection verified automatic native-addon activation and Windows behavior that creates a hidden temporary file and launches a process after anti-debug and process-inspection checks. This is concrete concealed execution behavior, despite no inspected network or credential transfer.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Package installation or importing index.js on Windows.
Impact
This can conceal and run a child process without a user-invoked package command.
Mechanism
The addon checks for a debugger, inspects running processes, creates a temporary file, marks it hidden, and launches a process.
Attack narrative
The postinstall hook and import entrypoint load the Windows native addon automatically. Its inspected behavior checks for a debugger, enumerates processes, creates a hidden temporary file, and launches a child process. This concealed process-launch behavior is sufficient for blocking; the bounded analysis does not resolve every native call target.
AI rationale
Source inspection verified automatic native-addon activation and Windows behavior that creates a hidden temporary file and launches a process after anti-debug and process-inspection checks. This is concrete concealed execution behavior, despite no inspected network or credential transfer.
Evidence
package.jsonindex.js.lpm-inspection-9axOyu/1-1d65d381b520.txt
Decision evidence
public snapshotAI called this Malicious at 91.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json defines an automatic postinstall that loads the platform native addon and suppresses load errors.
- index.js loads the platform native addon when the package is imported.
- The Windows addon checks for a debugger and enumerates running processes.
- The Windows addon creates a temporary file, marks it hidden, and calls CreateProcessA.
- The offline analysis reports that some native call targets remain uninspected.
Evidence against
- The inspected source and bounded native analysis show no network endpoint or credential transfer.
Behavioral surface
DynamicRequire
Trivial
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node -e "try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}"
Critical
Red Install Lifecycle Script
Install-time lifecycle script matches a deterministic static-gate block pattern.
package.jsonView on unpkg•scripts.postinstall = node -e "try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}"
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg7"postinstall": "node -e \"try{require(process.platform==='win32'?'./addon_win.node':'./addon.node')}catch(e){}\""
},
"keywords": [
"cache",
"utils"
],
"license": "M
High
Suspicious Lifecycle Evidence
package.json defines an automatic postinstall that loads the platform native addon and suppresses load errors.
package.jsonView on unpkg · L7Findings
1 Critical7 High3 Medium1 Low
CriticalRed Install Lifecycle Scriptpackage.json
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-9axOyu/1-1d65d381b520.txt
HighAi Review Evidence.lpm-inspection-9axOyu/1-1d65d381b520.txt
HighAi Review Evidence.lpm-inspection-9axOyu/1-1d65d381b520.txt
HighAi Review Evidence.lpm-inspection-9axOyu/1-1d65d381b520.txt
MediumDynamic Requireindex.js
MediumShips Native Binaryaddon.node
MediumStructural Risk Force Deep Review
LowScripts Present
Affected versions and remediation
This report applies to @testsecuiitytestme/cache-helper@1.0.1.
See all versions of @testsecuiitytestme/cache-helper for other recorded verdicts.
- Avoid installing @testsecuiitytestme/cache-helper@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.