adbf@1.0.130
adbf
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe package has an active, opaque server capability on import, but inspected evidence does not prove a concrete malicious action. It should be warned for unresolved runtime risk rather than blocked.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Importing index.js, including through the adbf CLI.
Impact
A local HTTP interface is opened with an unresolved service surface; no confirmed data theft, persistence, or destructive action was found.
Mechanism
The entrypoint selects PORT or 3001 and invokes the application listener; routes and handlers are heavily obfuscated.
AI rationale
The package has an active, opaque server capability on import, but inspected evidence does not prove a concrete malicious action. It should be warned for unresolved runtime risk rather than blocked.
Evidence
index.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes index.js as both the module entrypoint and the CLI implementation.
- The CLI immediately imports the package entrypoint.
- The obfuscated entrypoint constructs and starts an HTTP application when imported, using PORT or port 3001.
- The large single-line bundle obscures its routes and runtime behavior, preventing a reliable verification of its exposed service surface.
Evidence against
- package.json contains no preinstall, install, or postinstall lifecycle hook.
- No concrete credential-harvesting or outbound exfiltration sink was verified from the inspected source excerpts.
Behavioral surface
CryptoDynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsPossibleObfuscationUrlStrings
Source & flagged code
13 flagged · loading sourceindex.jsView file
1var a0_0x52c040=a0_0x5de2;(function(_0x3a4e7d,_0x793b92){var _0x353104=a0_0x5de2,_0x25fc10=_0x3a4e7d();while(!![]){try{var _0x6a8550=-parseInt(_0x353104(0x1835))/0x1*(-parseInt(_0x...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11var a0_0x52c040=a0_0x5de2;(function(_0x3a4e7d,_0x793b92){var _0x353104=a0_0x5de2,_0x25fc10=_0x3a4e7d();while(!![]){try{var _0x6a8550=-parseInt(_0x353104(0x1835))/0x1*(-parseInt(_0x...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11var a0_0x52c040=a0_0x5de2;(function(_0x3a4e7d,_0x793b92){var _0x353104=a0_0x5de2,_0x25fc10=_0x3a4e7d();while(!![]){try{var _0x6a8550=-parseInt(_0x353104(0x1835))/0x1*(-parseInt(_0x...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1Findings
5 Critical6 High4 Medium4 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighBase64 Obscured Urlindex.js
HighSemantic Analysis Limitedindex.js
MediumDynamic Requireindex.js
Affected versions and remediation
This report applies to adbf@1.0.130.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.130 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.