event-emitter-testmetest@3.0.1
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe unexplained encrypted payload warrants a warning, but the inspected source does not execute or expose its decrypted contents. No active attack behavior was confirmed.
Static reason
No blocking static signals were detected.
Trigger
Loading the package entrypoint.
Impact
The opaque payload is processed in memory during import; its purpose remains unresolved, with no observed network or filesystem effect.
Mechanism
The entrypoint decrypts embedded data into a local variable, then exports an empty object.
AI rationale
The unexplained encrypted payload warrants a warning, but the inspected source does not execute or expose its decrypted contents. No active attack behavior was confirmed.
Evidence
index.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The manifest names index.js as the package entrypoint and declares no lifecycle script.
- On import, index.js decrypts a large embedded AES-GCM blob into a local string.
- The decrypted string is not used; the module exports an empty object.
Evidence against
- The inspected source shows no network request, filesystem write, or execution of the decrypted string.
Behavioral surface
Crypto
MinifiedTrivial
NoLicense
Source & flagged code
3 flagged · loading sourcepackage.jsonView file
1{"name":"event-emitter-testmetest","version":"3.0.1","main":"index.js"}
Medium
Suspicious Lifecycle Evidence
The manifest names index.js as the package entrypoint and declares no lifecycle script.
package.jsonView on unpkg · L1index.jsView file
1const {createDecipheriv}=require("crypto");
const k=Buffer.from("[redacted]","hex");
const i=Buffer.from("ac11b5ba1642c47d082014b4","hex");
const d=createDecipheriv("aes-128-gcm",k,i,{authTagLength:16});
d.setAuthTag(Buffer.from("578cb8bda88d15ceb9c81051b76
Medium
Ai Review Evidence
On import, index.js decrypts a large embedded AES-GCM blob into a local string.
index.jsView on unpkg · L17[redacted]","hex")),d.final()]).toString("utf8");
module.exports={};
Medium
Ai Review Evidence
The decrypted string is not used; the module exports an empty object.
index.jsView on unpkg · L7Findings
3 Medium1 Low
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidenceindex.js
LowNo License
Affected versions and remediation
This report applies to event-emitter-testmetest@3.0.1.
See all versions of event-emitter-testmetest for other recorded verdicts.
- Review the evidence and your use of event-emitter-testmetest@3.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.