@viertechjs/wb@6.0.0-vier.7: Malicious npm security report

Loading npm security reports…

@viertechjs/wb@6.0.0-vier.7: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/core/connection.jsView file

1var i=O;(function(r,g){var I=O,b=r();while(!![]){try{var k=parseInt(I(0x1b1b))/(0xc64+-0x53*0x4c+-0xc41*-0x1)*(-parseInt(I(0x174d))/(-0x243a*0x1+0x11*0x163+0xca9))

High

Ai Review Evidence

Fifty-four runtime files are heavily obfuscated into single-line string-table payloads, preventing meaningful source review.

lib/core/connection.jsView on unpkg · L1

lib/index.jsView file

117const cryptokey_js_1 = __importDefault(require("./utils/cryptokey.js")); exports.CryptoKey = cryptokey_js_1.default; const chiper_js_1 = __importDefault(require("./utils/chiper.js")); exports.Chiper = chiper_js_1.default; const connection_js_1 = __importDefault(require("./core/connection.js")); exports.Client = connection_js_1.default;

High

Ai Review Evidence

Importing the main entrypoint immediately loads several of these opaque modules.

lib/index.jsView on unpkg · L117

109const CACHE_DIR = path_1.default.join(process.cwd(), ".cache"); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true }); }

High

Ai Review Evidence

The main entrypoint creates a project-local .cache directory during import.

lib/index.jsView on unpkg · L109

Source & flagged code

6 flagged · loading source

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/core/connection.jsView file

1var i=O;(function(r,g){var I=O,b=r();while(!![]){try{var k=parseInt(I(0x1b1b))/(0xc64+-0x53*0x4c+-0xc41*-0x1)*(-parseInt(I(0x174d))/(-0x243a*0x1+0x11*0x163+0xca9))

High

Ai Review Evidence

Fifty-four runtime files are heavily obfuscated into single-line string-table payloads, preventing meaningful source review.

lib/core/connection.jsView on unpkg · L1

lib/index.jsView file

High

Ai Review Evidence

Importing the main entrypoint immediately loads several of these opaque modules.

lib/index.jsView on unpkg · L117

109const CACHE_DIR = path_1.default.join(process.cwd(), ".cache"); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true }); }

High

Ai Review Evidence

The main entrypoint creates a project-local .cache directory during import.

lib/index.jsView on unpkg · L109

Source & flagged code

6 flagged

examples/sticker-pack.jsView file

1const { StickerPack } = require('@viertech/wb') L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/sticker-pack.jsView on unpkg · L1

lib/utils/sticker-pack.jsView file

6package = @viertechjs/wb; repositoryIdentity = viertech-wb; dependency = fflate L6: const path = require('path') L7: const { zip } = require('fflate') L8:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/utils/sticker-pack.jsView on unpkg · L6

package.jsonView file

•Runtime dependency names matching Node built-ins: path

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

lib/core/connection.jsView file

1var i=O;(function(r,g){var I=O,b=r();while(!![]){try{var k=parseInt(I(0x1b1b))/(0xc64+-0x53*0x4c+-0xc41*-0x1)*(-parseInt(I(0x174d))/(-0x243a*0x1+0x11*0x163+0xca9))

High

Ai Review Evidence

Fifty-four runtime files are heavily obfuscated into single-line string-table payloads, preventing meaningful source review.

lib/core/connection.jsView on unpkg · L1

lib/index.jsView file

High

Ai Review Evidence

Importing the main entrypoint immediately loads several of these opaque modules.

lib/index.jsView on unpkg · L117

109const CACHE_DIR = path_1.default.join(process.cwd(), ".cache"); if (!node_fs_1.default.existsSync(CACHE_DIR)) { node_fs_1.default.mkdirSync(CACHE_DIR, { recursive: true }); }

High

Ai Review Evidence

The main entrypoint creates a project-local .cache directory during import.

lib/index.jsView on unpkg · L109

@viertechjs/wb@6.0.0-vier.7

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code