array-flatten-utils@1.0.2
Lightweight array utilities for Node.js
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe Windows native module performs gated, concealed payload execution automatically when the package is imported, which is unrelated to its stated array utility purpose. The other platform binaries could not be analyzed, but the confirmed Windows behavior supports a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Importing index.js, which requires native_win.node on Windows.
Impact
Executes concealed code on the user's machine during import; the payload's further behavior is not established from the available binary view.
Mechanism
The native module applies environment, process, resource, and anti-debug checks, writes decoded embedded bytes under the temporary directory with a .napi_cache suffix, marks the file hidden, and launches it as a process.
Attack narrative
On Windows, importing the package loads its native module twice. The module screens the environment and running processes, writes decoded embedded bytes to a hidden file in the temporary directory, then launches that file. This concealed execution is unrelated to the package's array utilities.
AI rationale
The Windows native module performs gated, concealed payload execution automatically when the package is imported, which is unrelated to its stated array utility purpose. The other platform binaries could not be analyzed, but the confirmed Windows behavior supports a malicious verdict.
Evidence
index.js.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt%TEMP%\\<pid>.napi_cache
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing index.js loads the platform native module twice before exporting the array helpers.
- The Windows native module checks environment variables and screens processes, system resources, and debugger state before proceeding.
- It writes decoded embedded bytes to a temporary-path file named with a .napi_cache suffix, marks the file hidden, and launches it with CreateProcessA.
- The package description and JavaScript exports are array utilities; the automatic native payload behavior is unrelated to that purpose.
Evidence against
- The manifest has no lifecycle scripts, bin, or declared dependencies.
- The Windows binary view shows no network APIs among its listed imports.
- The ELF and Mach-O binary views are unsupported, so their behavior could not be established.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
8 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434065
magicHex = [redacted]
Medium
index.jsView file
1try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='darwin')require('./native_mac.node');else require('./native.napi.node')}catch(_){}
try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='dar
High
Ai Review Evidence
Importing index.js loads the platform native module twice before exporting the array helpers.
index.jsView on unpkg · L1.lpm-inspection-sA3KGc/2-cdefbd4ff465.txtView file
Findings
7 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-sA3KGc/2-cdefbd4ff465.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to array-flatten-utils@1.0.2.
See all versions of array-flatten-utils for other recorded verdicts.
- Avoid installing array-flatten-utils@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.