registry / ethers-3rc20 / 1.0.0
ethers-3rc20@1.0.0
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has no install hook, and the inspected source does not prove a concrete attack. Its heavily obfuscated runtime loader and exports prevent a reliable benign assessment, so a warning is appropriate.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package through its declared main entrypoint.
Impact
Consumers cannot readily assess whether importing or calling the exports causes hidden side effects; no specific attack was confirmed.
Mechanism
The entrypoint builds a dynamic require target from encoded fragments, and the loaded source encodes its strings and exported function names.
AI rationale
The package has no install hook, and the inspected source does not prove a concrete attack. Its heavily obfuscated runtime loader and exports prevent a reliable benign assessment, so a warning is appropriate.
Evidence
main-ethers.jsethers3.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The package entrypoint dynamically requires a target assembled from encoded fragments, and the main source uses a large obfuscated string table.
- The main source imports database helpers and exports many functions through encoded names, leaving its runtime behavior difficult to assess.
- The package has no install, preinstall, or postinstall hook; its declared dependency is mysql2.
Evidence against
- The inspected source does not establish credential theft, destructive behavior, or remote code execution.
- The manifest contains no install lifecycle hook.
Behavioral surface
DynamicRequire
HighEntropyStringsMinifiedObfuscatedTrivial
Source & flagged code
8 flaggedethers3.jsView file
1const a0_0x4abad2=a0_0x3f2e;(function(_0x4f06c8,_0x5a923f){const a0_0x1ac22a={_0x22b854:0x257,_0x4531d1:0x44b,_0x2afb62:0x434,_0x3e5856:0x26d,_0xd8087e:0x173,_0x35c36f:0x259},_0x1e...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
ethers3.jsView on unpkg · L11const a0_0x4abad2=a0_0x3f2e;(function(_0x4f06c8,_0x5a923f){const a0_0x1ac22a={_0x22b854:0x257,_0x4531d1:0x44b,_0x2afb62:0x434,_0x3e5856:0x26d,_0xd8087e:0x173,_0x35c36f:0x259},_0x1e...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
ethers3.jsView on unpkg · L11const a0_0x4abad2=a0_0x3f2e;(function(_0x4f06c8,_0x5a923f){const a0_0x1ac22a={_0x22b854:0x257,_0x4531d1:0x44b,_0x2afb62:0x434,_0x3e5856:0x26d,_0xd8087e:0x173,_0x35c36f:0x259},_0x1e1071=a0_0x3f2e,_0x4ae66b=_0x4f06c8();while(!![]){try{const _0x1ae6a7=parseInt(_0x1e1071(a0_0x1ac22a._0x22b854))/0x1*(-parseInt(_0x1e1071(0x34e))/0x2)+parseInt(_0x1e1071(0x186))/0x3*(parseInt(_0x1e1071(a0_0x1ac22a._0x4531d1))/0x4)+parseInt(_0x1e1071(0x105))/0x5+parseInt(_0x1e1071(a0_0x1ac22a._0x2afb62))/0x6+parseInt(_0x1e1071(a0_0x1ac22a._0x3e5856))/0x7+-parseInt(_0x1e1071(a0_0x1ac22a._0xd8087e))/0x8+-parseInt(_0x1e10
Medium
Findings
2 High8 Medium2 Low
HighObfuscated Payload Loaderethers3.js
HighObfuscated
MediumDynamic Requireethers3.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencemain-ethers.js
MediumAi Review Evidenceethers3.js
MediumAi Review Evidenceethers3.js
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-2fc14149-8e93-438e-93b6-1c7702d68a75/0/npm-linux/package.json
MediumSuspicious Lifecycle Evidence.lpm-dependency-evidence-2fc14149-8e93-438e-93b6-1c7702d68a75/0/npm-linux/index.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ethers-3rc20@1.0.0.
See all versions of ethers-3rc20 for other recorded verdicts.
- Review the evidence and your use of ethers-3rc20@1.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.