adbf@1.0.211
adbf
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package contains an active server route that forwards submitted data to a Telegram bot API client and a database. The route is mounted by the server started from the package entrypoint, supporting a malicious data exfiltration verdict.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the package command starts the server; a request to its data route triggers the forwarding.
Impact
Submitted data is disclosed to external services controlled by the package operator.
Mechanism
The route accepts whois, application, and content fields, then passes them to code that sends the content through a Telegram bot API client and stores the fields in a database.
Attack narrative
Running the package command loads the main module and starts a server. A request to its data route submits identifying and content fields to a helper that forwards them through a Telegram bot API client and stores them in a database. This is an active data disclosure path in the package source.
AI rationale
The package contains an active server route that forwards submitted data to a Telegram bot API client and a database. The route is mounted by the server started from the package entrypoint, supporting a malicious data exfiltration verdict.
Evidence
package.jsonbin/adbfindex.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest selects index.js as the main module and exposes a command that loads the package.
- The command requires the package, activating its main module.
- A server route accepts submitted whois, application, and content fields and passes them to a helper.
- The helper sends the submitted content through a Telegram bot API client and stores the fields in a database.
- The package mounts the route and starts listening for requests.
Evidence against
Behavioral surface
DynamicRequireEnvironmentVarsEvalFilesystem
HighEntropyStringsMinifiedObfuscatedUrlStrings
Oversized source lightweight scan
index.js7.16 MB file, sampled 256 KB
FilesystemEnvironmentVarsEvalDynamicRequireObfuscatedHighEntropyStringsMinifiedUrlStringsfeross.orggithub.comjimmy.warting.sewww.apache.org
Source & flagged code
13 flagged · loading sourceindex.jsView file
1var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
index.jsView on unpkg · L11var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
Critical
Browser Credential Phishing
Source appears to collect browser login credentials for exfiltration.
index.jsView on unpkg · L11var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L11Trigger-reachable chain: manifest.main -> index.js
L1: var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg · L1•matchType = previous_version_dangerous_delta
matchedPackage = adbf@1.0.207
matchedIdentity = npm:YWRiZg:1.0.207
similarity = 0.500
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
index.jsView on unpkg1var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
High
1var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
index.jsView on unpkg · L1•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
index.js:
var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
High
Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
index.jsView on unpkg1var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L11Trigger-reachable command-output exfiltration chain: manifest.main -> index.js
L1: var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
High
Trigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
index.jsView on unpkg · L1•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.jsView on unpkg1var a0_0x1706be=a0_0x4e94;(function(_0x1c145b,_0x193c2e){var _0x3932c3=a0_0x4e94,_0x181a43=_0x1c145b();while(!![]){try{var _0x1b6a0a=parseInt(_0x3932c3(0x23e))/0x1*(parseInt(_0x393...
L2:
Medium
•path = index.js
kind = oversized_source_file
sizeBytes = 7508884
magicHex = [redacted]
Medium
Oversized Source File
Package contains source files above the normal full-analysis size ceiling.
index.jsView on unpkgFindings
5 Critical7 High4 Medium4 Low
CriticalCommand Output Exfiltrationindex.js
CriticalBrowser Credential Phishingindex.js
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
CriticalPrevious Version Dangerous Deltaindex.js
HighEvalindex.js
HighSame File Env Network Executionindex.js
HighCredential Redirect Persistenceindex.js
HighObfuscated Payload Loaderindex.js
HighTrigger Reachable Command Output Exfiltrationindex.js
HighObfuscated
HighSemantic Analysis Limitedindex.js
MediumDynamic Requireindex.js
MediumEnvironment Vars
MediumOversized Source Fileindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to adbf@1.0.211.
See all versions of adbf for other recorded verdicts.
- Avoid installing adbf@1.0.211. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.