adbf@1.0.115
adbf
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis release has no lifecycle trigger, but its opaque runtime network behavior and inert encoded destructive repository payload create a concrete unresolved supply-chain risk. The payload is not referenced, so a malicious verdict is not justified solely by static source.
Decision evidence
public snapshot- The package includes an encoded shell script that deletes the repository metadata and force-pushes a replacement history.
- The executable source is deliberately heavily obfuscated and embeds base64-decoded API credentials, endpoint data, and a system prompt.
- When the CLI is run, importing the main module starts a network-facing server and sends supplied chat messages to the hidden AI service.
- package.json has no preinstall, install, or postinstall hook.
- The destructive shell text is in a separate file and no source reference to that file was found.
Source & flagged code
7 flagged · loading sourceThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
index.jsView on unpkgA single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.jsView on unpkg · L1Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to adbf@1.0.115.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.115 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.