registry / @xylex-group/athena / 5.6.7
@xylex-group/athena@5.6.7
Athena JS SDK
AI Security Review
scanned 25d ago · by lpm-firewall-aiThe inspected manifest has no install lifecycle hook, and the reviewed launchers and required bundle entrypoints show normal SDK and CLI behavior. No concrete malicious behavior was identified.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
No malicious trigger was identified.
Impact
No confirmed malicious impact was established.
Mechanism
No install-time execution, credential exfiltration, or foreign control-surface mutation was found.
AI rationale
The inspected manifest has no install lifecycle hook, and the reviewed launchers and required bundle entrypoints show normal SDK and CLI behavior. No concrete malicious behavior was identified.
Decision evidence
public snapshotAI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes build and checking scripts; inspection found no install lifecycle hook.
- The development launcher runs the local CLI only when invoked.
- The inspected ESM, CommonJS, server, and CLI bundles construct SDK version headers.
- The bootstrap logger sanitizes CLI arguments before logging.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
13 flagged · loading sourcebin/athena-js-dev.mjsView file
5*/
L6: import { spawn } from "node:child_process";
L7: import path from "node:path";
High
Child Process
Package source references child process execution.
bin/athena-js-dev.mjsView on unpkg · L5•matchType = normalized_sha256
matchedPackage = @xylex-group/athena@5.5.4
matchedPath = bin/athena-js-dev.mjs
matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/athena-js-dev.mjsView on unpkgdist/index.jsView file
1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto';
L2: import { AsyncLocalStorage } from 'async_hooks';
...
L10: import { z } from 'zod';
L11: import { spawn } from 'child_process';
L12: import { argon2id } from '@noble/hashes/argon2.js';
...
L176: super({
L177: body: { missing: input.missing, operation: input.operation },
L178: code: ATHENA_BILLING_AUTHORIZATION_DENIED,
...
L392:
L393: // package.json
L394: var package_default;
...
L817: init_errors2();
Findings
3 Critical10 High4 Medium5 Low
CriticalRemote Asset Decode Executedist/index.js
CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs
CriticalManifest Confusionpackage.json
HighChild Processbin/athena-js-dev.mjs
HighShell
HighEvaldist/index.js
HighCredential Redirect Persistencedist/index.cjs
HighCommand Output Exfiltrationdist/next/server.js
HighCloud Metadata Accessdist/next/server.js
HighCross File Remote Execution Contextdist/cli/index.cjs
HighSemantic Analysis Limiteddist/index.cjs
HighKnown Malware Source Similaritybin/bootstrap-logging.js
Affected versions and remediation
This report applies to @xylex-group/athena@5.6.7.
See all versions of @xylex-group/athena for other recorded verdicts.
- Review the evidence and your use of @xylex-group/athena@5.6.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.