registry / @xylex-group/athena / 5.6.9

@xylex-group/athena@5.6.9

Athena JS SDK

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Static inspection found no install lifecycle hook or concrete malicious behavior. Network and process primitives observed were tied to configured SDK requests, Git metadata, or explicit CLI Docker execution.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

No malicious trigger was found; the reviewed commands require normal user or application invocation.

Impact

No confirmed malicious impact was established.

Mechanism

No install-time mutation, credential harvesting, hidden payload execution, or agent-control write was found in the inspected paths.

AI rationale

Evidence

package.jsonbin/athena-js-dev.mjsbin/bootstrap-logging.jsdist/index.jsdist/index.cjsdist/next/server.jsdist/cli/index.cjs

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

The package scripts shown are build and checking commands; inspection found no npm install lifecycle hook.
The development launcher starts the declared TypeScript CLI with Node and forwards user arguments.
Bootstrap logging stores CLI logs under the configured Athena home directory or ~/.athena.
The ESM and CommonJS SDK transports use caller-supplied gateway configuration for ordinary API requests.
The Next server build helper only reads Git revision and working-tree status.
The CLI launches Docker without a shell.

Evidence against

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 44.2 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.atlassian.com, api.dropboxapi.com, api.figma.com, api.github.com, api.kick.com, api.line.me, api.linear.app, api.linkedin.com, api.mollie.com, api.notion.com, api.paypal.com, api.polar.sh, api.resend.com, api.sandbox.paypal.com, api.spotify.com, api.stripe.com, api.vercel.com, api.weixin.qq.com, api.x.com, api.zoom.us, apis.roblox.com, appleid.apple.com, athena.invalid, athena.local, auth.athena-auth.com, auth.atlassian.com, auth.example.com, backboard.railway.com, cdn.discordapp.com, discord.com, github.com, gitlab.com, graph.facebook.com, graph.microsoft.com, huggingface.co, id.kick.com, id.twitch.tv, id.vk.com, idp.paybin.io, kapi.kakao.com, kauth.kakao.com, limited.facebook.com, linear.app, login.microsoftonline.com

Source & flagged code

13 flagged

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

•matchType = normalized_sha256 matchedPackage = @xylex-group/athena@5.5.4 matchedPath = bin/athena-js-dev.mjs matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/athena-js-dev.mjsView on unpkg

dist/index.jsView file

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L10: import { z } from 'zod'; L11: import { spawn } from 'child_process'; L12: import { argon2id } from '@noble/hashes/argon2.js'; ... L176: super({ L177: body: { missing: input.missing, operation: input.operation }, L178: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L392: L393: // package.json L394: var package_default; ... L817: init_errors2();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L1

25566function createRuntimeImport() { L25567: return new Function("moduleSpecifier", "return import(moduleSpecifier)"); L25568: }

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L25566

bin/athena-js.jsView file

232}); L233: const cliModule = await import(cliEntrypointUrl); L234: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L232

dist/index.cjsView file

11Trigger-reachable chain: manifest.main -> dist/index.cjs L11: var z3 = require('zod'); L12: var child_process = require('child_process'); L13: var argon2_js = require('@noble/hashes/argon2.js'); ... L201: super({ L202: body: { missing: input.missing, operation: input.operation }, L203: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L417: L418: // package.json L419: var package_default; ... L568: // src/auth/bridge/code.ts L569: function toBase64Url(bytes) { L570: let binary = "";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L11

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR; exports.AthenaBillingError = void 0; var ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERV... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends exports.AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError"; authorizationAuditLog: "athena.authorization_audit_log",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

dist/next/server.jsView file

1import { createHmac, createHash, createDecipheriv, randomBytes, createCipheriv, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L14: import { fileURLToPath } from 'url'; L15: import { execSync } from 'child_process'; L16: ... L461: init_errors(); L462: ATHENA_AUTH_DEV_DEFAULT_ISSUER = "http://localhost:3000"; L463: } ... L755: ); L756: if (process.env.NODE_ENV === "production" && !origin.startsWith("https://")) { L757: throw new AthenaConfigurationError( ... L1149:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L1

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L1

dist/cli/index.cjsView file

11Cross-file remote execution chain: dist/cli/index.cjs spawns dist/index.cjs; helper contains network access plus dynamic code execution. L11: var promises = require('fs/promises'); L12: var child_process = require('child_process'); L13: var promises$1 = require('timers/promises'); ... L37: L38: // package.json L39: var package_default; ... L1290: const isTty = options.isTty ?? Boolean( L1291: globalThis.process?.stdout?.isTTY L1292: ); ... L2523: function isAsciiAlphanumeric(ch) { L2524: const code = ch.charCodeAt(0); L2525: return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L11

package.jsonView file

•dependencies registry_only=@xylex-group/athena

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

bin/bootstrap-logging.jsView file

•matchType = normalized_sha256 matchedPackage = @xylex-group/athena@5.5.4 matchedPath = bin/bootstrap-logging.js matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/bootstrap-logging.jsView on unpkg

Source & flagged code

13 flagged · loading source

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/athena-js-dev.mjsView on unpkg

dist/index.jsView file

Findings

3 Critical10 High4 Medium5 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalManifest Confusionpackage.json

HighChild Processbin/athena-js-dev.mjs

HighShell

HighEvaldist/index.js

HighCredential Redirect Persistencedist/index.cjs

HighCommand Output Exfiltrationdist/next/server.js

HighCloud Metadata Accessdist/next/server.js

HighCross File Remote Execution Contextdist/cli/index.cjs

HighSemantic Analysis Limiteddist/index.cjs

HighKnown Malware Source Similaritybin/bootstrap-logging.js

Affected versions and remediation

This report applies to @xylex-group/athena@5.6.9.

See all versions of @xylex-group/athena for other recorded verdicts.

Review the evidence and your use of @xylex-group/athena@5.6.9 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-27 15:05:20.251Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.