@testsecuiitytestme/cache-helper@1.0.2
Cache helper utilities
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe native addon performs concealed temporary-file execution when the package is imported, which is concrete malicious behavior. The inspected Windows analysis supports this finding; it does not establish the behavior of the unsupported Linux artifact.
Static reason
No blocking static signals were detected.
Trigger
A consumer imports the package.
Impact
The package can execute generated code in a child process during import.
Mechanism
The entrypoint loads the platform prebuild; its module initialization routine writes temporary data, sets the file's hidden attribute, and calls CreateProcessA with a command line referencing the file.
Attack narrative
On Windows, importing the package reaches its native prebuild. Native module registration runs a routine that writes data into a temporary file, marks it hidden, and starts a process with a command line referencing that file. This is active, concealed code execution during package use.
AI rationale
The native addon performs concealed temporary-file execution when the package is imported, which is concrete malicious behavior. The inspected Windows analysis supports this finding; it does not establish the behavior of the unsupported Linux artifact.
Evidence
package.jsonindex.js.lpm-dependency-evidence-eac6460c-0d0e-49b2-a0d6-8b43519d2f35/0/npm-linux/node-gyp-build.js.lpm-inspection-d6k11n/0-620d2489e18b.txtprebuilds/win32-x64/node.napi.node
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json names index.js as the entrypoint, and index.js immediately loads the native addon through the prebuild loader.
- The loader resolves a platform-matching prebuild and requires the selected file.
- The Windows addon runs native code during module registration; that code writes data to a temporary file, marks it hidden, and passes a command line to CreateProcessA.
- The native behavior is reachable when a consumer imports the package.
Evidence against
Behavioral surface
NativeBindings
Trivial
Source & flagged code
10 flaggedpackage.jsonView file
•scripts.postinstall = node-gyp-build
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "index.js",
"scripts": {
"postinstall": "node-gyp-build"
},
"dependencies": {
"node-gy
High
Ai Review Evidence
package.json names index.js as the entrypoint, and index.js immediately loads the native addon through the prebuild loader.
package.jsonView on unpkg · L5prebuilds/win32-x64/node.napi.nodeView file
•path = prebuilds/win32-x64/node.napi.node
kind = native_binary
sizeBytes = 433565
magicHex = [redacted]
Medium
Ships Native Binary
Package ships native binary artifacts.
Findings
9 High1 Medium1 Low
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-dependency-evidence-eac6460c-0d0e-49b2-a0d6-8b43519d2f35/0/npm-linux/node-gyp-build.js
HighAi Review Evidence.lpm-dependency-evidence-eac6460c-0d0e-49b2-a0d6-8b43519d2f35/0/npm-linux/node-gyp-build.js
HighAi Review Evidence.lpm-inspection-d6k11n/0-620d2489e18b.txt
HighAi Review Evidence.lpm-inspection-d6k11n/0-620d2489e18b.txt
HighAi Review Evidence.lpm-inspection-d6k11n/0-620d2489e18b.txt
HighAi Review Evidence.lpm-inspection-d6k11n/0-620d2489e18b.txt
MediumShips Native Binaryprebuilds/win32-x64/node.napi.node
Affected versions and remediation
This report applies to @testsecuiitytestme/cache-helper@1.0.2.
See all versions of @testsecuiitytestme/cache-helper for other recorded verdicts.
- Avoid installing @testsecuiitytestme/cache-helper@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.