axon-web@11.0.0
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe package entry point performs import-time environment fingerprinting and exports no substantive API. This creates a real metadata exposure risk in logs, but the inspected source does not establish network transfer or another confirmed attack.
Static reason
No blocking static signals were detected.
Trigger
Importing the package through its manifest entry point.
Impact
The metadata may be exposed in application or build logs.
Mechanism
The entry point reads system and environment details and writes them to the console.
AI rationale
The package entry point performs import-time environment fingerprinting and exports no substantive API. This creates a real metadata exposure risk in logs, but the inspected source does not establish network transfer or another confirmed attack.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest points to index.js as the package entry point and declares no lifecycle scripts.
- Loading index.js immediately prints the machine hostname, user name, working directory, runtime version, and platform, then exports an empty object.
Evidence against
- The inspected entry point contains no network transfer; the observed metadata is written to the process output.
Behavioral surface
EnvironmentVars
HighEntropyStrings
Source & flagged code
2 flaggedpackage.jsonView file
1{
"name": "axon-web",
"version": "11.0.0",
"description": "Web utilities module",
"main": "index.js",
"keywords": [],
"author": "",
"license": "ISC"
}
Medium
Suspicious Lifecycle Evidence
The manifest points to index.js as the package entry point and declares no lifecycle scripts.
package.jsonView on unpkg · L1index.jsView file
1const os = require('os');
console.log('=== DEPENDENCY CONFUSION PoC: axon-web ===');
console.log('Loaded from: PUBLIC npm registry (npmjs.com)');
console.log('Hostname:', os.hostname());
console.log('User:', process.env.USER || process.env.USERNAME || 'unknown');
console.log('cwd:', process.cwd());
console.log('node:', process.version);
console.log('platform:', os.platform(), os.arch());
console.log('This code ran because axon-web was not scoped/protected on public npm.');
module.exports = {};
Medium
Ai Review Evidence
Loading index.js immediately prints the machine hostname, user name, working directory, runtime version, and platform, then exports an empty object.
index.jsView on unpkg · L1Findings
3 Medium1 Low
MediumEnvironment Vars
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to axon-web@11.0.0.
See all versions of axon-web for other recorded verdicts.
- Review the evidence and your use of axon-web@11.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.