dilxztech@1.0.9: Malicious npm security report (Block)

Loading npm security reports…

dilxztech@1.0.9: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/self-test.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/self-test.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

scripts/self-test.jsView file

36try { L37: const mod = await import(path.join(packageRoot, 'lib', 'index.js')); L38: const ok = typeof mod.default === 'function';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/self-test.jsView on unpkg · L36

lib/Utils/validate-connection.jsView file

107pull: false, L108: devicePairingData: { L109: buildHash: appVersionBuf, ... L134: const { details, hmac, accountType } = proto.ADVSignedDeviceIdentityHMAC.decode(deviceIdentityNode.content); L135: let hmacPrefix = Buffer.from([]); L136: if (accountType !== undefined && accountType === proto.ADVEncryptionType.HOSTED) { ... L158: ]); L159: account.deviceSignature = Curve.sign(signedIdentityKey.private, deviceMsg); L160: const identity = createSignalIdentity(lid, accountSignatureKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8484673 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/antiban.jsView file

•matchType = normalized_sha256 matchedPackage = my-baileys@1.0.2 matchedPath = lib/antiban.js matchedIdentity = npm:bXktYmFpbGV5cw:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/antiban.jsView on unpkg

lib/Utils/messages-media.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = dilxztech@1.0.8 matchedIdentity = npm:ZGlseHp0ZWNo:1.0.8 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/self-test.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/self-test.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

scripts/self-test.jsView file

36try { L37: const mod = await import(path.join(packageRoot, 'lib', 'index.js')); L38: const ok = typeof mod.default === 'function';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/self-test.jsView on unpkg · L36

lib/Utils/validate-connection.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8484673 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/antiban.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/antiban.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

•scripts.postinstall = node ./scripts/self-test.js || exit 0

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/self-test.js || exit 0

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/WABinary/constants.jsView file

600patternName = google_api_key severity = high line = 600

High

High Secret

Package contains a high-severity secret pattern.

lib/WABinary/constants.jsView on unpkg · L600

600patternName = google_api_key severity = high line = 600

High

Secret Pattern

Google API key in lib/WABinary/constants.js

lib/WABinary/constants.jsView on unpkg · L600

scripts/self-test.jsView file

36try { L37: const mod = await import(path.join(packageRoot, 'lib', 'index.js')); L38: const ok = typeof mod.default === 'function';

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/self-test.jsView on unpkg · L36

lib/Utils/validate-connection.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/Utils/validate-connection.jsView on unpkg · L107

WAProto/GenerateStatics.shView file

•path = WAProto/GenerateStatics.sh kind = build_helper sizeBytes = 302 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

WAProto/GenerateStatics.shView on unpkg

WAProto/index.jsView file

•path = WAProto/index.js kind = oversized_source_file sizeBytes = 8484673 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

WAProto/index.jsView on unpkg

lib/Utils/business.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/Utils/business.jsView on unpkg

lib/antiban.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/antiban.jsView on unpkg

lib/Utils/messages-media.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/Utils/messages-media.jsView on unpkg

dilxztech@1.0.9

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code