registry / @tomaso909/jsguitools / 1.6.0

@tomaso909/jsguitools@1.6.0

Resuable front end components

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Importing the package executes its bundled entrypoint. From 2027 onward it deliberately throws, denying normal package use.

Static reason

One or more suspicious static signals were detected.

Trigger

Runtime import or loading of dist/index.obf.js on or after 2027.

Impact

Applications using the package fail at runtime after the cutoff.

Mechanism

Obfuscated date-triggered denial-of-service throw.

AI rationale

The obfuscated import-time date bomb is an intentional availability attack, unsupported by the ISC metadata or README. Absence of exfiltration does not mitigate the runtime denial of service. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

package.jsondist/index.obf.js

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Malware with medium false-positive risk.

Evidence for warning

dist/index.obf.js ends with a hidden year check and throw.
The check is `getFullYear() > 0x7ea` (2026), causing failure from 2027.
package.json makes this obfuscated bundle the main/module entrypoint.

@tomaso909/jsguitools@1.6.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code