evt-dispatcher@1.0.5
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Windows native addon automatically executes decoded content from .napi_cache when the package is imported, behavior unrelated to the stated event-dispatcher purpose. The staged program itself is unreadable here, so the evidence supports a warning for an automatic payload carrier rather than a definitive malware finding.
Static reason
No blocking static signals were detected.
Trigger
Importing the package on Windows.
Impact
The staged program can execute automatically with the importing process's privileges; its behavior is unknown.
Mechanism
The addon reads .napi_cache, XOR-transforms the bytes, writes them under the Windows temporary directory, and invokes CreateProcessA.
AI rationale
The Windows native addon automatically executes decoded content from .napi_cache when the package is imported, behavior unrelated to the stated event-dispatcher purpose. The staged program itself is unreadable here, so the evidence supports a warning for an automatic payload carrier rather than a definitive malware finding.
Evidence
index.js.napi_cachenative_win.node.lpm-inspection-kWG3wG/1-8392fb2fbf79.txt.lpm-inspection-kWG3wG/0-603b601b47d5.txtWindows temporary directory (PID-based path)
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Importing index.js immediately loads a platform-specific native addon.
- The Windows addon refers to a .napi_cache file.
- The Windows addon reads the cache file and XOR-transforms its contents.
- The Windows addon writes decoded bytes to a temporary file and calls CreateProcessA.
Evidence against
- The package is described as a lightweight event dispatcher and exports a small EventBus implementation.
- package.json declares no lifecycle scripts or dependencies.
- The Windows analysis does not show a network API import; the Linux native artifact remains unanalyzed.
Behavioral surface
NativeBindings
Source & flagged code
6 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434065
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
tr
Medium
Ai Review Evidence
Importing index.js immediately loads a platform-specific native addon.
index.jsView on unpkg · L1.lpm-inspection-kWG3wG/1-8392fb2fbf79.txtView file
176fileOffset=0x7920 xor=0x0 candidate="%s\\.napi_cache"
fileOffset=0x7a00 xor=0x0 candidate=
Findings
6 Medium
MediumShips Native Binarynative_win.node
MediumAi Review Evidenceindex.js
MediumAi Review Evidence.lpm-inspection-kWG3wG/1-8392fb2fbf79.txt
MediumAi Review Evidence.lpm-inspection-kWG3wG/1-8392fb2fbf79.txt
MediumAi Review Evidence.lpm-inspection-kWG3wG/1-8392fb2fbf79.txt
MediumAi Review Evidence.lpm-inspection-kWG3wG/1-8392fb2fbf79.txt
Affected versions and remediation
This report applies to evt-dispatcher@1.0.5.
See all versions of evt-dispatcher for other recorded verdicts.
- Review the evidence and your use of evt-dispatcher@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.