@viertechjs/wb@6.0.0-vier.3: Malicious npm security report

Loading npm security reports…

@viertechjs/wb@6.0.0-vier.3: Malicious npm security report | LPM Firewall

Source & flagged code

5 flagged

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/index.jsView file

114const connection_js_1 = __importDefault(require("./core/connection.js"));

High

Ai Review Evidence

Main import loads a heavily obfuscated core module.

lib/index.jsView on unpkg · L114

lib/core/connection.jsView file

1var i=O;(function(r,g){var I=O,b=r();while(!![]){try{var k=parseInt(I(0x1b1b))/(0xc64+-0x53*0x4c+-0xc41*-0x1)*(-parseInt(I(0x174d))/(-0x243a*0x1+0x11*0x163+0xca9))

High

Ai Review Evidence

Core behavior cannot be reliably source-audited due to opaque encoded dispatch code.

lib/core/connection.jsView on unpkg · L1

Source & flagged code

5 flagged · loading source

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/index.jsView file

114const connection_js_1 = __importDefault(require("./core/connection.js"));

High

Ai Review Evidence

Main import loads a heavily obfuscated core module.

lib/index.jsView on unpkg · L114

lib/core/connection.jsView file

1var i=O;(function(r,g){var I=O,b=r();while(!![]){try{var k=parseInt(I(0x1b1b))/(0xc64+-0x53*0x4c+-0xc41*-0x1)*(-parseInt(I(0x174d))/(-0x243a*0x1+0x11*0x163+0xca9))

High

Ai Review Evidence

Core behavior cannot be reliably source-audited due to opaque encoded dispatch code.

lib/core/connection.jsView on unpkg · L1

@viertechjs/wb@6.0.0-vier.3

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code