adbf@1.0.201
adbf
AI Security Review
scanned 14d ago · by lpm-firewall-aiThe encoded command sequence presents a concrete risk if decoded and run, but the manifest has no install hook and no automatic execution path to the carrier was established. Classify as suspicious and warn for the inert payload carrier.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user or external process would need to decode and run the file's contents.
Impact
If run in a project, it could overwrite that project's Git history on the configured remote.
Mechanism
The encoded sequence removes local Git metadata, changes the package version, configures a replacement remote, and force-pushes.
AI rationale
The encoded command sequence presents a concrete risk if decoded and run, but the manifest has no install hook and no automatic execution path to the carrier was established. Classify as suspicious and warn for the inert payload carrier.
Evidence
atob.txt
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Malware with medium false-positive risk.
Evidence for warning
- atob.txt contains a base64-encoded command sequence that removes the Git metadata, changes the package version, replaces the Git remote, and force-pushes to that remote.
- package.json points its main entrypoint to index.js and defines no install lifecycle hook; inspection did not establish automatic execution of the encoded commands.
Evidence against
- The encoded command sequence is in a separate text file, and no connection from the package entrypoint to that file was established.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedObfuscatedUrlStrings
Oversized source lightweight scan
Source & flagged code
16 flagged · loading sourceindex.jsView file
1var a0_0x1fedd5=a0_0x384a;(function(_0x3aefbb,_0x583e31){var _0x1b8427=a0_0x384a,_0x5228f4=_0x3aefbb();while(!![]){try{var _0x3b5b79=-parseInt(_0x1b8427(0x179f))/0x1+parseInt(_0x1b...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11var a0_0x1fedd5=a0_0x384a;(function(_0x3aefbb,_0x583e31){var _0x1b8427=a0_0x384a,_0x5228f4=_0x3aefbb();while(!![]){try{var _0x3b5b79=-parseInt(_0x1b8427(0x179f))/0x1+parseInt(_0x1b...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11var a0_0x1fedd5=a0_0x384a;(function(_0x3aefbb,_0x583e31){var _0x1b8427=a0_0x384a,_0x5228f4=_0x3aefbb();while(!![]){try{var _0x3b5b79=-parseInt(_0x1b8427(0x179f))/0x1+parseInt(_0x1b...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1Findings
5 Critical9 High4 Medium5 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighChild Processindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighCredential Redirect Persistenceindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighBase64 Obscured Urlindex.js
Affected versions and remediation
This report applies to adbf@1.0.201.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.201 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.