array-flatten-utils@1.0.1
Lightweight array utilities for Node.js
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically loads a Windows native module that decodes and executes a staged JavaScript payload, with checks for analysis tools. This is concealed, unrelated execution triggered by import, so the package is malicious.
Static reason
No blocking static signals were detected.
Trigger
Automatically when the package is imported on Windows.
Impact
Executes concealed code on the user’s machine during import.
Mechanism
Reads and decodes the packaged `.napi_cache` payload, writes a temporary JavaScript file, then starts it with Node; it also checks for debugging and analysis tools.
Attack narrative
Importing the package on Windows loads a native module that reads an opaque `.napi_cache` payload, decodes it, stages a temporary JavaScript file and launches it through Node. The module also checks for debugger and analysis processes. This automatic behavior is unrelated to the package’s array helpers.
AI rationale
The package automatically loads a Windows native module that decodes and executes a staged JavaScript payload, with checks for analysis tools. This is concealed, unrelated execution triggered by import, so the package is malicious.
Evidence
index.jsnative_win.node.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt.napi_cache%TEMP%\<pid>.nc%lu.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- On import, index.js synchronously loads a platform-specific native module.
- The Windows native module reads a `.napi_cache` file and XOR-decodes its contents.
- It writes the decoded payload to a temporary `.js` file and launches it with `CreateProcessA`; embedded strings identify a `node` command.
- The native module checks for debugger presence and process names associated with analysis tools.
Evidence against
- The JavaScript exports ordinary `flatten`, `compact` and `unique` array helpers.
- The manifest declares no lifecycle scripts or dependencies.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
9 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434215
magicHex = [redacted]
Medium
index.jsView file
1try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='darwin')require('./native_mac.node');else require('./native.napi.node')}c
High
Ai Review Evidence
On import, index.js synchronously loads a platform-specific native module.
index.jsView on unpkg · L1.lpm-inspection-ikHnuV/2-4295cc8e7e84.txtView file
8493164d1935: 4c 8d 05 e4 77 00 00 lea r8, [rip + 0x77e4] # 0x3164d9120 <.rdata+0x120>
3164d193c: e8 bf fb ff ff call 0x3164d1500 <snprintf>
3164d1941: 4c 89 e1 mov rcx, r12
3164d1944: 4
Findings
8 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
HighAi Review Evidence.lpm-inspection-ikHnuV/2-4295cc8e7e84.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to array-flatten-utils@1.0.1.
See all versions of array-flatten-utils for other recorded verdicts.
- Avoid installing array-flatten-utils@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.