adbf@1.0.205
adbf
AI Security Review
scanned 6d ago · by lpm-firewall-aiThe executable entrypoint loads a substantially obfuscated bundle, and the package includes an unexplained encoded payload. Because the inspected source does not establish payload execution or another concrete attack, warn rather than block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Invoking the adbf CLI loads the package entrypoint.
Impact
Unresolved: if the payload is used, it may enable harmful actions; this review did not verify such use.
Mechanism
The CLI requires the package; atob.txt contains encoded data, but no inspected source links it to execution.
AI rationale
The executable entrypoint loads a substantially obfuscated bundle, and the package includes an unexplained encoded payload. Because the inspected source does not establish payload execution or another concrete attack, warn rather than block.
Evidence
index.jsatob.txtpackage.jsonbin/adbf
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The CLI loads index.js, a heavily obfuscated bundle, when invoked.
- atob.txt contains an opaque Base64 payload; its relationship to the CLI is unresolved.
Evidence against
- package.json defines no install lifecycle hook, and the CLI entrypoint only requires the package.
- The inspected source does not establish that atob.txt is read or executed.
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedObfuscatedUrlStrings
Oversized source lightweight scan
index.js7.12 MB file, sampled 256 KB
Filesystem
Source & flagged code
14 flagged · loading sourceindex.jsView file
1var a0_0x4b888a=a0_0x1607;(function(_0x122889,_0x2cfe07){var _0x44ed57=a0_0x1607,_0x686e14=_0x122889();while(!![]){try{var _0x498a32=-parseInt(_0x44ed57(0x587a))/0x1+parseInt(_0x44...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11var a0_0x4b888a=a0_0x1607;(function(_0x122889,_0x2cfe07){var _0x44ed57=a0_0x1607,_0x686e14=_0x122889();while(!![]){try{var _0x498a32=-parseInt(_0x44ed57(0x587a))/0x1+parseInt(_0x44...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11var a0_0x4b888a=a0_0x1607;(function(_0x122889,_0x2cfe07){var _0x44ed57=a0_0x1607,_0x686e14=_0x122889();while(!![]){try{var _0x498a32=-parseInt(_0x44ed57(0x587a))/0x1+parseInt(_0x44...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L1Findings
5 Critical8 High4 Medium4 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighCredential Redirect Persistenceindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighBase64 Obscured Urlindex.js
HighObfuscated
High
Affected versions and remediation
This report applies to adbf@1.0.205.
See all versions of adbf for other recorded verdicts.
- Review the evidence and your use of adbf@1.0.205 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.