registry / adbf / 1.0.111

adbf@1.0.111

adbf

AI Security Review

scanned 3d ago · by lpm-firewall-ai

Running the bin or importing the main file starts an obfuscated server. Its feedback endpoint forwards submitted fields to a hidden Telegram recipient.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

The user runs adbf or imports index.js, then a client submits feedback.

Impact

Client-submitted feedback is disclosed to an undisclosed third party.

Mechanism

Obfuscated external message relay

Rationale

No automatic installation-time attack was found, but explicit use activates an opaque server that forwards user data to a concealed external recipient. The bundled destructive artifact further supports malicious or unsafe intent.

Evidence

index.jsatob.txt

Decision evidence

public snapshot

AI called this Suspicious at 92.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The main file is a 7 MB deliberately obfuscated bundle.
A hidden Telegram bot sends values passed to its feedback function to an encoded recipient.
A request handler passes three client-supplied fields into that feedback function.
The package includes an unrelated base64 artifact that decodes to destructive Git-history replacement commands.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The exposed server is started only when the package is imported or its explicit bin command is run.
No automatic harvesting of local files, environment variables, or credentials was confirmed.

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsObfuscated

ManifestNo manifest risk signals triggered.

scanned 0 file(s), 256 KB of source

Oversized source lightweight scan

Source & flagged code

6 flagged

index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = adbf@1.0.104 matchedIdentity = npm:YWRiZg:1.0.104 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

1var a0_0x448aaf=a0_0x32af;(function(_0x5aec9b,_0x490e19){var _0x52feee=a0_0x32af,_0x563015=_0x5aec9b();while(!![]){try{var _0x59125a=-parseInt(_0x52feee(0x1e00))/0x1+-parseInt(_0x5... L2:

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.jsView on unpkg

1var a0_0x448aaf=a0_0x32af;(function(_0x5aec9b,_0x490e19){var _0x52feee=a0_0x32af,_0x563015=_0x5aec9b();while(!![]){try{var _0x59125a=-parseInt(_0x52feee(0x1e00))/0x1+-parseInt(_0x5... L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L1

•path = index.js kind = oversized_source_file sizeBytes = 7077163 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

index.jsView on unpkg

1var a0_0x448aaf=a0_0x32af;(function(_0x5aec9b,_0x490e19){var _0x52feee=a0_0x32af,_0x563015=_0x5aec9b();while(!![]){try{var _0x59125a=-parseInt(_0x52feee(0x1e00))/0x1+-parseInt(_0x52feee(0x66b))/0x2+parseInt(_0x52feee(0x2f6d))/0x3

Medium

Ai Review Evidence

The main file is a 7 MB deliberately obfuscated bundle.

index.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

1var a0_0x448aaf=a0_0x32af;(function(_0x5aec9b,_0x490e19){var _0x52feee=a0_0x32af,_0x563015=_0x5aec9b();while(!![]){try{var _0x59125a=-parseInt(_0x52feee(0x1e00))/0x1+-parseInt(_0x5... L2:

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.jsView on unpkg

Findings

1 Critical3 High5 Medium3 Low

CriticalPrevious Version Dangerous Deltaindex.js

HighObfuscated Payload Loaderindex.js

HighObfuscated

HighSemantic Analysis Limitedindex.js

MediumDynamic Requireindex.js

MediumEnvironment Vars

MediumOversized Source Fileindex.js

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.js

LowScripts Present

LowFilesystem

LowHigh Entropy Strings