registry / ethers-3rc20 / 14.0.0
ethers-3rc20@14.0.0
Ethers3 en npmjs con nodejs.
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe flagged obfuscated helper constructs database imports and exports database functions, while the package manifest has no install hook. The hard-coded fee wallet and key are used in the explicit gas-fee accounting path; inspected sources show no covert credential transfer or payload execution.
Static reason
One or more suspicious static signals were detected.
Trigger
A consumer calls an exported API method; the package manifest declares no install lifecycle hook.
Impact
No confirmed attack surface was established; the inspected behavior is application accounting and fee collection.
Mechanism
The entrypoint re-exports the token API, whose transfer method uses caller-supplied transaction fields and records the transfer and fee in the database.
AI rationale
The flagged obfuscated helper constructs database imports and exports database functions, while the package manifest has no install hook. The hard-coded fee wallet and key are used in the explicit gas-fee accounting path; inspected sources show no covert credential transfer or payload execution.
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with high false-positive risk.
Evidence for AI clean decision
- package.json selects main-ethers.js, depends on mysql2, and declares only a test script; it has no install lifecycle hook.
- The prepared mysql2 dependency has a CommonJS index.js entrypoint and is a MySQL driver; its inspected entrypoint exports connection and pool APIs.
- bethers.js uses string-table obfuscation to construct a require and export database helper functions; inspection found no eval or Function execution.
- The exported transfer API takes sender, recipient, amount, symbol, and chain ID from its caller's txObject and validates the sender credentials.
- Transfer accounting credits the calculated gas fee to the package's configured fee wallet.
- The package entrypoint re-exports ethers3.js.
Evidence against
Behavioral surface
DynamicRequire
HighEntropyStringsMinifiedObfuscated
Source & flagged code
8 flaggedethers3.jsView file
1const { initDB, run, get, all, transaction } = require('./bethers.js');
L2:
Medium
Dynamic Require
Package source references dynamic require/import behavior.
ethers3.jsView on unpkg · L1458ensureTables();
const {
fromAddress,
fromPrivateKey,
to,
value,
symbol,
chainId
} = txObject;
try {
await validateCredentials(fromAddress, fromPrivateKey);
} catch (err) {
return {
state: 'failed',
reason: err.message
};
}
let normalizedSymbol;
let normalizedChainId;
let network;
try {
const verified = validateSymbolAndChainId(symbol, chainId);
normalizedSymbol = verified.symbol;
norma
Low
Ai Review Evidence
The exported transfer API takes sender, recipient, amount, symbol, and chain ID from its caller's txObject and validates the sender credentials.
ethers3.jsView on unpkg · L458bethers.jsView file
1const a0_0x2d854f=a0_0x41f0;(function(_0x49863a,_0x1b510e){const a0_0x5176d5={_0x5dfb61:0x19a,_0x535ede:0x1c2,_0xc930eb:0x1bd,_0x2ea395:0x1d7,_0x2c70b0:0x1fd},_0x5862b4=a0_0x41f0,_...
Findings
2 High2 Medium8 Low
HighObfuscated Payload Loaderbethers.js
HighObfuscated
MediumDynamic Requireethers3.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a1cf779c-e8f4-4e8f-8f8a-7dd8179cc287/0/npm-linux/package.json
LowSuspicious Dependency Evidence.lpm-dependency-evidence-a1cf779c-e8f4-4e8f-8f8a-7dd8179cc287/0/npm-linux/index.js
LowAi Review Evidencebethers.js
LowAi Review Evidencebethers.js
LowAi Review Evidenceethers3.js
Affected versions and remediation
This report applies to ethers-3rc20@14.0.0.
See all versions of ethers-3rc20 for other recorded verdicts.
- Review the evidence and your use of ethers-3rc20@14.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.