registry / ethers-3rc20 / 1.1.0
ethers-3rc20@1.1.0
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe package has no install hook, and the inspected dependency files show ordinary MySQL library behavior. The heavily obfuscated active runtime remains unresolved, so a warning is appropriate without asserting a confirmed attack.
Static reason
One or more suspicious static signals were detected.
Trigger
Requiring the package through its declared entrypoint.
Impact
The unreadable runtime leaves unresolved risk about behavior after import; no specific harm was confirmed.
Mechanism
The entrypoint loads an obfuscated runtime that builds module-loading arguments from encoded strings.
AI rationale
The package has no install hook, and the inspected dependency files show ordinary MySQL library behavior. The heavily obfuscated active runtime remains unresolved, so a warning is appropriate without asserting a confirmed attack.
Evidence
main-ethers.jsethers3.jspackage.json
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The declared entrypoint is an obfuscated wrapper that loads the package runtime.
- The runtime uses an obfuscated string table and assembled module loading, leaving its behavior difficult to verify from readable source.
- The package declares mysql2, whose inspected entrypoint exposes ordinary database connection functionality.
Evidence against
- The manifest has no install lifecycle hook.
- No concrete credential theft, unrelated network transfer, or destructive action was established in the inspected excerpts.
Behavioral surface
DynamicRequire
HighEntropyStringsMinifiedObfuscatedTrivial
Source & flagged code
8 flaggedethers3.jsView file
1const a0_0x4abad2=a0_0x3f2e;(function(_0x4f06c8,_0x5a923f){const a0_0x1ac22a={_0x22b854:0x257,_0x4531d1:0x44b,_0x2afb62:0x434,_0x3e5856:0x26d,_0xd8087e:0x173,_0x35c36f:0x259},_0x1e...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
ethers3.jsView on unpkg · L11const a0_0x4abad2=a0_0x3f2e;(function(_0x4f06c8,_0x5a923f){const a0_0x1ac22a={_0x22b854:0x257,_0x4531d1:0x44b,_0x2afb62:0x434,_0x3e5856:0x26d,_0xd8087e:0x173,_0x35c36f:0x259},_0x1e...
Medium
Dynamic Require
Package source references dynamic require/import behavior.
ethers3.jsView on unpkg · L11t']());}catch(_0x4fb081){_0x4ae66b['push'](_0x4ae66b['shift']());}}}(a0_0x50f3,0x40cb7));const {initDB:a0_0x27f99a,run:a0_0x4fca01,get:a0_0x5d5725,all:a0_0x3d1ac8,transaction:a0_0x
Medium
Ai Review Evidence
The runtime uses an obfuscated string table and assembled module loading, leaving its behavior difficult to verify from readable source.
ethers3.jsView on unpkg · L1Findings
2 High8 Medium2 Low
HighObfuscated Payload Loaderethers3.js
HighObfuscated
MediumDynamic Requireethers3.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidenceethers3.js
MediumAi Review Evidenceethers3.js
MediumAi Review Evidencemain-ethers.js
MediumAi Review Evidence.lpm-dependency-evidence-15c17036-2a6d-4c9d-a63d-f6ad383e7566/0/npm-linux/package.json
MediumAi Review Evidence.lpm-dependency-evidence-15c17036-2a6d-4c9d-a63d-f6ad383e7566/0/npm-linux/index.js
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to ethers-3rc20@1.1.0.
See all versions of ethers-3rc20 for other recorded verdicts.
- Review the evidence and your use of ethers-3rc20@1.1.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.