evt-dispatcher@1.0.2
Lightweight event dispatcher for Node.js
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Windows native module is loaded automatically at import and performs concealed temporary-file and process-launch behavior unrelated to event dispatch. This is concrete malicious execution behavior.
Static reason
No blocking static signals were detected.
Trigger
Importing index.js on Windows.
Impact
Automatic execution of concealed code during package import.
Mechanism
The native binary writes a buffer to a process-specific file under the system temp directory, hides it, then launches Node.js with a temp addon_rebuild path.
Attack narrative
On Windows, importing the package automatically loads native_win.node. Its native code writes a buffer to a process-specific temporary `.napi_cache` file, marks the file hidden, and calls CreateProcessA to launch Node.js with a temporary addon_rebuild path. This concealed execution has no apparent connection to the package’s event-dispatcher purpose.
AI rationale
The Windows native module is loaded automatically at import and performs concealed temporary-file and process-launch behavior unrelated to event dispatch. This is concrete malicious execution behavior.
Evidence
index.js.lpm-inspection-UE6jj8/1-6ad598561b79.txt%TEMP%\<pid>.napi_cache%TEMP%\addon_rebuild\addon_*
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing index.js automatically loads a platform-specific native binary and suppresses loading errors.
- The Windows binary contains code that writes a buffer to a process-specific `.napi_cache` path in the system temp directory and marks the file hidden.
- The Windows binary constructs a Node.js command for a temp `addon_rebuild` path and calls `CreateProcessA` to launch it.
Evidence against
- The manifest has no lifecycle scripts or declared dependencies.
- The advertised JavaScript API is a small event emitter, but the Linux native artifact could not be structurally analyzed.
Behavioral surface
NativeBindings
Source & flagged code
4 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434097
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
'use strict';
class EventBus {
constructor() { th
High
Ai Review Evidence
Importing index.js automatically loads a platform-specific native binary and suppresses loading errors.
index.jsView on unpkg · L1.lpm-inspection-UE6jj8/1-6ad598561b79.txtView file
916call qword ptr [rip + 0xc859] # 0x3164de2c0 <__imp_GetCurrentProcessId> ; KERNEL32.dll!GetCurrentProcessId
3164d1a67: 49 89 f1 mov r9, rsi
3164d1a6a: ba 24 01 00 00 mov edx, 0x124
3164d1a6f: 48 89 f9 mov rcx, rdi
3164d1a72: 89 44 24 20 mov dword ptr [rsp + 0x20], eax
3164d1a76: 4c 8d 05 b5 76 00 00 lea r8, [rip + 0x76b5] # 0x3164d9132 <.rdata+0x132>
3164d1a7d: e8 7e fa ff ff call 0x3164d1500 <snprintf>
3164d1a82: 48 8d 15 b5 76 00 00 lea rdx, [rip + 0x76b5] # 0x3164d913e <.
High
Ai Review Evidence
The Windows binary contains code that writes a buffer to a process-specific `.napi_cache` path in the system temp directory and marks the file hidden.
.lpm-inspection-UE6jj8/1-6ad598561b79.txtView on unpkg · L91696078], 0x0
3164d1b3e: 48 c7 84 24 80 00 00 00 00 00 00 00 mov qword ptr [rsp + 0x80], 0x0
3164d1b4a: 48 89 44 24 40 mov qword ptr [rsp + 0x40], rax
3164d1b4f: 48 c7 44 24 38 00 00 00 00 mov qword ptr [rsp + 0x38], 0x0
3164d1b58: 48 c7 44 24 30 00 00 00 00 mov qword ptr [rsp + 0x30], 0x0
3164d1b61: c7 44 24 28 08 02 00 08 mov dword ptr [rsp + 0x28], 0x8000208
3164d1b69: c7 44 24 20 00 00 00 00 mov dword ptr [rsp + 0x20], 0x0
3164d1b71: ff 15 21 c7 00 00 call qword ptr [rip + 0xc721] # 0x3164de298 <__imp_CreateProcessA> ; KERNEL32.dll!CreateProcess
High
Ai Review Evidence
The Windows binary constructs a Node.js command for a temp `addon_rebuild` path and calls `CreateProcessA` to launch it.
.lpm-inspection-UE6jj8/1-6ad598561b79.txtView on unpkg · L960Findings
3 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-UE6jj8/1-6ad598561b79.txt
HighAi Review Evidence.lpm-inspection-UE6jj8/1-6ad598561b79.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to evt-dispatcher@1.0.2.
See all versions of evt-dispatcher for other recorded verdicts.
- Avoid installing evt-dispatcher@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.