adbf@1.0.195
adbf
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, but the active entrypoint is heavily obfuscated and contains dynamic evaluation, leaving runtime behavior unresolved. The available source excerpts do not prove a concrete attack, so a warning is appropriate.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Importing or running the package entrypoint; the embedded browser code runs on page load if executed in a browser context.
Impact
No concrete data theft, destructive behavior, or external payload execution was established; the opaque entrypoint leaves unresolved risk.
Mechanism
Obfuscated bundle code includes eval and browser logic that fetches a relative URL derived from the page origin.
AI rationale
The manifest has no install lifecycle hook, but the active entrypoint is heavily obfuscated and contains dynamic evaluation, leaving runtime behavior unresolved. The available source excerpts do not prove a concrete attack, so a warning is appropriate.
Evidence
index.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The active package entrypoint is a heavily obfuscated, multi-megabyte bundle that includes dynamic evaluation.
- The bundle contains browser code that automatically requests a same-origin route when the page loads, but its connection to the package’s Node entrypoint is unclear.
Evidence against
- package.json has no install lifecycle scripts, so the package does not automatically run an install hook.
- The inspected browser request uses a relative same-origin route; no credential collection or unrelated recipient was confirmed.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedObfuscatedUrlStrings
Oversized source lightweight scan
Source & flagged code
14 flagged · loading sourceindex.jsView file
1var a0_0x373346=a0_0x1ae0;(function(_0x50465b,_0x5d695a){var _0x52433a=a0_0x1ae0,_0x418cb9=_0x50465b();while(!![]){try{var _0x3bf383=-parseInt(_0x52433a(0x265f))/0x1+-parseInt(_0x5...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11var a0_0x373346=a0_0x1ae0;(function(_0x50465b,_0x5d695a){var _0x52433a=a0_0x1ae0,_0x418cb9=_0x50465b();while(!![]){try{var _0x3bf383=-parseInt(_0x52433a(0x265f))/0x1+-parseInt(_0x5...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11var a0_0x373346=a0_0x1ae0;(function(_0x50465b,_0x5d695a){var _0x52433a=a0_0x1ae0,_0x418cb9=_0x50465b();while(!![]){try{var _0x3bf383=-parseInt(_0x52433a(0x265f))/0x1+-parseInt(_0x5...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1Findings
5 Critical8 High4 Medium4 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighCredential Redirect Persistenceindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighBase64 Obscured Urlindex.js
HighObfuscated
High
Affected versions and remediation
This report applies to adbf@1.0.195.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.195 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.