adbf@1.0.147
adbf
AI Security Review
scanned 24d ago · by lpm-firewall-aiThe absence of lifecycle hooks reduces automatic-install risk, but the opaque import-time entry contains dynamic evaluation and encrypted decoding. This is a real unresolved risk requiring a warning rather than a clean verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Importing index.js or running the exposed command-line binary.
Impact
The hidden behavior cannot be safely verified; no confirmed attack surface was established.
Mechanism
Opaque decoder code, encrypted data handling, and eval prevent reliable static attribution of the executed behavior.
AI rationale
The absence of lifecycle hooks reduces automatic-install risk, but the opaque import-time entry contains dynamic evaluation and encrypted decoding. This is a real unresolved risk requiring a warning rather than a clean verdict.
Evidence
index.js
Decision evidence
public snapshotAI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package metadata selects index.js as its main entry and exposes a command-line binary; it declares no installation lifecycle hook.
- The main entry begins with an obfuscated string-table decoder and opaque hexadecimal property selectors.
- The main entry evaluates generated text with eval.
- The entry includes encrypted base64 payload decoding and a reference to agent authentication.
Evidence against
- No installation lifecycle hook was found.
- Static inspection did not establish a credential collection path, an outbound send sink, destructive action, or a concrete persistence mechanism.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsObfuscatedUrlStrings
Source & flagged code
13 flagged · loading sourceindex.jsView file
1var a0_0x57ae52=a0_0x5eec;(function(_0x5de4c7,_0xc6b302){var _0x54d5f7=a0_0x5eec,_0x159cd3=_0x5de4c7();while(!![]){try{var _0x45fe61=-parseInt(_0x54d5f7(0x29a))/0x1+-parseInt(_0x54...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11var a0_0x57ae52=a0_0x5eec;(function(_0x5de4c7,_0xc6b302){var _0x54d5f7=a0_0x5eec,_0x159cd3=_0x5de4c7();while(!![]){try{var _0x45fe61=-parseInt(_0x54d5f7(0x29a))/0x1+-parseInt(_0x54...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11var a0_0x57ae52=a0_0x5eec;(function(_0x5de4c7,_0xc6b302){var _0x54d5f7=a0_0x5eec,_0x159cd3=_0x5de4c7();while(!![]){try{var _0x45fe61=-parseInt(_0x54d5f7(0x29a))/0x1+-parseInt(_0x54...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1Findings
5 Critical7 High4 Medium4 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighBase64 Obscured Urlindex.js
HighObfuscated
HighSemantic Analysis Limitedindex.js
MediumDynamic Require
Affected versions and remediation
This report applies to adbf@1.0.147.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.147 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.