evm-validation
This report shows the evidence for evm-validation@1.0.3. 3 of 4 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2mo ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-14301 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The hidden network destination and silent failure handling create unresolved risk, though the observed request aligns with the package's stated validation role and no concrete malicious chain is present.
Independent scan evidence
public snapshot- index.js obfuscates its endpoint with ROT13 and reversal.
- validated(e) sends e in an outbound axios GET.
- The function suppresses all request errors.
- package.json has no install lifecycle hooks.
- index.js contains no file/env access, shell execution, eval, or persistence.
- README describes a validation API, consistent with the exposed function.
Source & flagged code
0 flagged · loading sourceFindings
Affected versions and remediation
This report applies to evm-validation@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing evm-validation@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.