registry / @xylex-group/athena / 5.6.0

@xylex-group/athena@5.6.0

Athena JS SDK

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Source inspection does not establish malicious behavior, but the required high-risk artifacts cannot all be source-cited within the citation limit and the package contains broad user-invoked runtime capabilities. Downgrade to a warning rather than publishing a block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user invokes the CLI or configures email attachment delivery.

Impact

The CLI can create local diagnostics and configured email delivery can fetch public attachment URLs.

Mechanism

User-configured CLI, SDK, and SMTP attachment operations.

AI rationale

Decision evidence

public snapshot

AI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The published manifest has a release-only prepublish hook, not an install hook.
The explicit development launcher spawns the package's own TypeScript CLI with inherited user arguments and environment.
The CLI bootstrap writes local diagnostic logs when its user-invoked logging mode is enabled.
The bundles use Function-based module loading for Node crypto compatibility and runtime imports.
The email module fetches user-supplied SMTP attachment URLs, although it rejects private network destinations.

Evidence against

No preinstall, install, or postinstall script is present.
No runtime dependency on this package name is declared.
No source evidence shows credential exfiltration, remote payload retrieval, or AI-agent configuration changes.
The development launcher is explicitly labeled as a workspace development tool.
Attachment fetching includes DNS and private-address checks.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVars

Source & flagged code

15 flagged

bin/athena-js-dev.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Workspace-dev CLI: runs TypeScript `src/cli/bin.ts` via tsx.

4 * Production `bin/athena-js.js` continues to load packed `dist/cli/index.js`.

5 */

6import { spawn } from "node:child_process";

7import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

8import { fileURLToPath } from "node:url";

10const binPath = fileURLToPath(import.meta.url);

11const packageRoot = path.resolve(path.dirname(binPath), "..");

12const entry = path.join(packageRoot, "src", "cli", "bin.ts");

13const projectCwd = process.cwd();

15const child = spawn(

16 process.execPath,

17 ["--import", "tsx", entry, "--cwd", projectCwd, ...process.argv.slice(2)],

18 {

19 cwd: packageRoot,

20 env: process.env,

21 stdio: "inherit",

22 }

23);

25child.on("exit", (code, signal) => {

•matchType = normalized_sha256 matchedPackage = @xylex-group/athena@5.5.4 matchedPath = bin/athena-js-dev.mjs matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/athena-js-dev.mjsView on unpkg

dist/index.jsView file

1import { createHash, createDecipheriv, randomBytes, randomUUID, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1 } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L186: super({ L187: body: { missing: input.missing, operation: input.operation }, L188: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L383: L384: // package.json L385: var package_default; ... L1050: const social = normalizeSocialFromRaw(raw); L1051: const envForIdentity = options.env ?? process.env; L1052: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L1803: init_inspect();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L1

22036function createRuntimeImport() { L22037: return new Function("moduleSpecifier", "return import(moduleSpecifier)"); L22038: }

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L22036

bin/athena-js.jsView file

Lines 212-252javascript

212 if (isVersionArgv(argv)) {

213 const short = argv.includes("--short") || argv.includes("-q");

214 const version

dist/index.cjsView file

211Trigger-reachable chain: manifest.main -> dist/index.cjs L211: super({ L212: body: { missing: input.missing, operation: input.operation }, L213: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L408: L409: // package.json L410: var package_default; ... L559: // src/auth/bridge/code.ts L560: function toBase64Url(bytes) { L561: let binary = ""; ... L1075: const social = normalizeSocialFromRaw(raw); L1076: const envForIdentity = options.env ?? process.env; L1077: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L211

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR; exports.AthenaBillingError = void 0; var ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERV... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends exports.AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError"; authorizationAuditLog: "athena.authorization_audit_log",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

dist/next/server.jsView file

1import { createHash, createDecipheriv, randomBytes, randomUUID, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1 } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L14: import { fileURLToPath } from 'url'; L15: import { execSync } from 'child_process'; L16: ... L698: const social = normalizeSocialFromRaw(raw); L699: const envForIdentity = options.env ?? process.env; L700: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L804: L805: // package.json L806: var package_default; ... L974: super({

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L1

1import { createHash, createDecipheriv, randomBytes, randomUUID, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1 } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L14: import { fileURLToPath } from 'url'; L15: import { execSync } from 'child_process'; L16: ... L698: const social = normalizeSocialFromRaw(raw); L699: const envForIdentity = options.env ?? process.env; L700: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L804: L805: // package.json L806: var package_default; ... L974: super({

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L1

dist/cli/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xylex-group/athena@5.5.1 matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.1 similarity = 0.611 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.cjsView on unpkg

11Cross-file remote execution chain: dist/cli/index.cjs spawns dist/index.cjs; helper contains network access plus dynamic code execution. L11: var pgsqlParser = require('pgsql-parser'); L12: var child_process = require('child_process'); L13: var os = require('os'); ... L31: L32: // package.json L33: var package_default; ... L1184: const isTty = options.isTty ?? Boolean( L1185: globalThis.process?.stdout?.isTTY L1186: ); ... L2415: function isAsciiAlphanumeric(ch) { L2416: const code = ch.charCodeAt(0); L2417: return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L11

package.jsonView file

•dependencies registry_only=@xylex-group/athena

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

bin/bootstrap-logging.jsView file

•matchType = normalized_sha256 matchedPackage = @xylex-group/athena@5.5.4 matchedPath = bin/bootstrap-logging.js matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bootstrap-logging.jsView on unpkg

dist/email/node.cjsView file

•matchType = normalized_sha256 matchedPackage = @xylex-group/athena@5.5.4 matchedPath = dist/email/node.cjs matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/email/node.cjsView on unpkg

dist/email/node.jsView file

•matchType = normalized_sha256 matchedPackage = @xylex-group/athena@5.5.4 matchedPath = dist/email/node.js matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/email/node.jsView on unpkg

Source & flagged code

15 flagged · loading source

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/athena-js-dev.mjsView on unpkg

dist/index.jsView file

Findings

4 Critical11 High4 Medium5 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalManifest Confusionpackage.json

CriticalPrevious Version Dangerous Deltadist/cli/index.cjs

HighChild Processbin/athena-js-dev.mjs

HighShell

HighEvaldist/index.js

HighCredential Redirect Persistencedist/index.cjs

HighCommand Output Exfiltrationdist/next/server.js

HighCloud Metadata Accessdist/next/server.js

HighCross File Remote Execution Contextdist/cli/index.cjs

HighKnown Malware Source Similaritybin/bootstrap-logging.js

Affected versions and remediation

This report applies to @xylex-group/athena@5.6.0.

See all versions of @xylex-group/athena for other recorded verdicts.

Review the evidence and your use of @xylex-group/athena@5.6.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-04 08:02:09.362Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code