array-flatten-utils@1.0.5
Lightweight array utilities for Node.js
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically loads a native module during import, and the Windows module decodes a bundled cache file, hides the output in the temp directory, and executes it. That concealed, unrelated payload execution warrants blocking the package.
Static reason
No blocking static signals were detected.
Trigger
Importing index.js, which loads native_win.node at top level.
Impact
Unrequested concealed code executes on the user's machine during package import.
Mechanism
The native module reads and XOR-decodes .napi_cache, writes the result to a hidden file in the system temp directory, then starts it with CreateProcessA.
Attack narrative
On Windows, importing index.js automatically loads native_win.node. Its module registration calls a routine that reads .napi_cache, XOR-decodes its contents, writes them to a hidden file in the system temp directory, and launches that file with CreateProcessA. This concealed execution is unrelated to the package's advertised array utilities.
AI rationale
The package automatically loads a native module during import, and the Windows module decodes a bundled cache file, hides the output in the temp directory, and executes it. That concealed, unrelated payload execution warrants blocking the package.
Evidence
index.jsnative_win.node.napi_cache.lpm-inspection-un7zLX/2-cdefbd4ff465.txta hidden file under the Windows system temp directory
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest describes a lightweight array utility package with index.js as its entrypoint.
- Importing index.js automatically loads a platform-specific native module twice and suppresses load errors.
- The Windows native module's registration function calls a routine named Run.
- The Windows binary references .napi_cache and XOR-decodes bytes read from it.
- The routine writes decoded bytes under the system temp directory, marks the file hidden, and calls CreateProcessA.
Evidence against
- index.js exports ordinary flatten, compact, and unique array helpers.
- The manifest declares no lifecycle scripts or dependencies.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
9 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434065
magicHex = [redacted]
Medium
package.jsonView file
2"name": "array-flatten-utils",
"version": "1.0.5",
"main": "index.js",
"description": "Lightweight arr
High
Ai Review Evidence
The manifest describes a lightweight array utility package with index.js as its entrypoint.
package.jsonView on unpkg · L2index.jsView file
1try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='darwin')require('./native_mac.node');else require('./native.napi.node')}catch(_){}
try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='darwin')require('./native_mac.node');else require('./
Findings
8 High1 Medium
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-un7zLX/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-un7zLX/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-un7zLX/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-un7zLX/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-un7zLX/2-cdefbd4ff465.txt
HighAi Review Evidence.lpm-inspection-un7zLX/2-cdefbd4ff465.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to array-flatten-utils@1.0.5.
See all versions of array-flatten-utils for other recorded verdicts.
- Avoid installing array-flatten-utils@1.0.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.