registry / evt-dispatcher / 1.0.6
evt-dispatcher@1.0.6
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically loads platform-specific native binaries during import, but the available analysis leaves their behavior unresolved. Since this capability is unexplained for the stated lightweight JavaScript event dispatcher, classify it as suspicious without claiming a concrete attack.
Static reason
No blocking static signals were detected.
Trigger
Requiring the package loads index.js, which immediately attempts to require a platform-specific native binary.
Impact
The native artifact’s import-time behavior is unknown; no concrete malicious action was established.
Mechanism
The entry point repeats the native load attempt five times and suppresses errors. Available offline analysis cannot establish the native code’s behavior.
AI rationale
The package automatically loads platform-specific native binaries during import, but the available analysis leaves their behavior unresolved. Since this capability is unexplained for the stated lightweight JavaScript event dispatcher, classify it as suspicious without claiming a concrete attack.
Evidence
index.jsnative_win.nodenative.napi.node
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Importing the package attempts to load a platform-specific native binary five times, suppressing any load errors.
- The Linux native artifact could not be structurally analyzed; the Windows artifact’s bounded call graph has uninspected targets.
- The package describes itself as a lightweight event dispatcher, but its entry point loads native code before exporting a JavaScript event bus.
Evidence against
- The entry point’s visible JavaScript export implements a conventional in-memory event emitter.
- No lifecycle scripts, dependencies, or network endpoints are declared in package.json.
Behavioral surface
NativeBindings
Source & flagged code
5 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434220
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node'
Medium
Ai Review Evidence
Importing the package attempts to load a platform-specific native binary five times, suppressing any load errors.
index.jsView on unpkg · L1package.jsonView file
2"name": "evt-dispatcher",
"version": "1.0.6",
"description": "Lightweight event dispatcher for Node.js",
"main": "index.js",
"license": "MIT",
"keywords":
Findings
5 Medium
MediumShips Native Binarynative_win.node
MediumAi Review Evidenceindex.js
MediumAi Review Evidencepackage.json
MediumAi Review Evidence.lpm-inspection-3lYmZ3/0-0ca9bb3e6eed.txt
MediumAi Review Evidence.lpm-inspection-3lYmZ3/1-9180bad6bf33.txt
Affected versions and remediation
This report applies to evt-dispatcher@1.0.6.
See all versions of evt-dispatcher for other recorded verdicts.
- Review the evidence and your use of evt-dispatcher@1.0.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.