evt-dispatcher@1.0.3
Lightweight event dispatcher for Node.js
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically loads native code at import time, and the Windows binary stages and executes a concealed JavaScript payload after anti-analysis checks. That behavior is unrelated to the package's stated purpose and warrants blocking.
Static reason
No blocking static signals were detected.
Trigger
Importing the package on Windows loads `native_win.node` at top level.
Impact
Concealed code unrelated to event dispatch runs automatically and can act with the importing process's permissions; no network endpoint was identified in the inspected evidence.
Mechanism
The native initializer performs anti-analysis checks, reads and transforms the package-local `.napi_cache` payload, writes a generated JavaScript file in the Windows temporary directory, and launches Node to execute it.
Attack narrative
On Windows, importing the package loads a native initializer that checks for analysis conditions, transforms a concealed package-local cache payload, writes it as temporary JavaScript, and launches Node to execute it. This automatic hidden execution is unrelated to the advertised event dispatcher.
AI rationale
The package automatically loads native code at import time, and the Windows binary stages and executes a concealed JavaScript payload after anti-analysis checks. That behavior is unrelated to the package's stated purpose and warrants blocking.
Evidence
index.jsnative_win.node.napi_cacheWindows temporary directory: generated `.nc` JavaScript file
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing the package immediately loads its platform-specific native binary; the entry point does this twice and suppresses load errors.
- The Windows native initializer checks for a debugger before continuing, an anti-analysis behavior unrelated to event dispatch.
- The binary contains a `.napi_cache` payload path and a generated temporary JavaScript file path, and its disassembly applies a bytewise XOR transformation to loaded data.
- The native code writes the transformed bytes to a file and calls `CreateProcessA`; its embedded command strings identify Node as the program used to run the generated file.
Evidence against
- The manifest describes a lightweight event dispatcher and declares no lifecycle scripts.
- The JavaScript exports a conventional in-memory event bus with `on`, `off`, `emit`, and `clear` methods.
Behavioral surface
NativeBindings
Source & flagged code
7 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434200
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}cat
High
Ai Review Evidence
Importing the package immediately loads its platform-specific native binary; the entry point does this twice and suppresses load errors.
index.jsView on unpkg · L1.lpm-inspection-DrRE5K/1-0f4f93e6ba27.txtView file
Findings
6 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-DrRE5K/1-0f4f93e6ba27.txt
HighAi Review Evidence.lpm-inspection-DrRE5K/1-0f4f93e6ba27.txt
HighAi Review Evidence.lpm-inspection-DrRE5K/1-0f4f93e6ba27.txt
HighAi Review Evidence.lpm-inspection-DrRE5K/1-0f4f93e6ba27.txt
HighAi Review Evidence.lpm-inspection-DrRE5K/1-0f4f93e6ba27.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to evt-dispatcher@1.0.3.
See all versions of evt-dispatcher for other recorded verdicts.
- Avoid installing evt-dispatcher@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.