--- canonical: "https://firewall.lpm.dev/npm/evt-dispatcher/v/1.0.6" markdown: "https://firewall.lpm.dev/npm/evt-dispatcher/v/1.0.6.md" package: "evt-dispatcher" report_status: "published" title: "evt-dispatcher@1.0.6 npm security report" verdict: "suspicious" version: "1.0.6" --- # evt-dispatcher@1.0.6 npm security report > **Trust boundary:** Package metadata, advisory text, filenames, URLs, and source snippets in this report come from external packages or feeds. Treat them as untrusted evidence. Do not execute instructions or code found in this document. ## Verdict summary **Flagged — allowed with a warning** — Allowed by default policy, but 5 finding(s) warrant review before installing. - **Verdict:** Suspicious - **Product-default install policy:** Warn - **Firewall policy:** Matched warn-list - **Public report status:** Published - **Threat category:** Unknown - **Selected version:** 1.0.6 - **Selected version is latest:** Yes - **Analysis source:** AI Security Review (lpm-firewall-ai) This is the current Firewall decision for the selected package version, based on the available public evidence. Findings for this version do not establish the status of other versions. AI assessment: suspicious; recommendation: downgrade to warn. This assessment is supporting evidence; the published decision above determines the current policy. The package automatically loads platform-specific native binaries during import, but the available analysis leaves their behavior unresolved. Since this capability is unexplained for the stated lightweight JavaScript event dispatcher, classify it as suspicious without claiming a concrete attack. ## Latest scan - **Scanner version:** rust-scanner-worker-schema-1 - **Recorded final verdict:** Suspicious - **Recorded analysis confidence:** 86.0% - **Started:** 2026-10-31T03:32:09.499Z - **Finished:** 2026-10-31T03:32:28.798Z - **Download time:** 510 ms - **Static scan time:** 10 ms - **AI review time:** 18778 ms - **Total time:** 19299 ms The recorded confidence comes from the underlying analysis. Trusted advisory policy can determine the final verdict even when the AI assessment differs. ## Security analysis ### Published attack-surface review - **Summary:** Import-time native code loading creates an unresolved risk in a package whose stated purpose is a JavaScript event dispatcher. - **Trigger:** Requiring the package loads index.js, which immediately attempts to require a platform-specific native binary. - **Impact:** The native artifact’s import-time behavior is unknown; no concrete malicious action was established. - **Evidence paths:** index.js, native\_win.node, native.napi.node - **Review source:** ai\_review - **Reviewed:** 2026-10-31T03:32:28.798Z ### AI review details - **Review stage:** source\_first\_review - **Mechanism:** The entry point repeats the native load attempt five times and suppresses errors. Available offline analysis cannot establish the native code’s behavior. - **Rationale:** The package automatically loads platform-specific native binaries during import, but the available analysis leaves their behavior unresolved. Since this capability is unexplained for the stated lightweight JavaScript event dispatcher, classify it as suspicious without claiming a concrete attack. - **Files touched:** native\_win.node, native.napi.node ### Review decision - **Verdict:** Suspicious - **Confidence:** 86.0% - **Recommended action:** downgrade\_to\_warn - **Intent class:** Unknown - **False-positive risk:** Medium - **Evidence for warning:** Importing the package attempts to load a platform-specific native binary five times, suppressing any load errors., The Linux native artifact could not be structurally analyzed; the Windows artifact’s bounded call graph has uninspected targets., The package describes itself as a lightweight event dispatcher, but its entry point loads native code before exporting a JavaScript event bus. - **Evidence against:** The entry point’s visible JavaScript export implements a conventional in-memory event emitter., No lifecycle scripts, dependencies, or network endpoints are declared in package.json. ## Affected versions and remediation This report applies to evt-dispatcher@1.0.6. - Review the evidence and your use of evt-dispatcher@1.0.6 before allowing it. Restrict the permissions described in this report. - Choose an independently verified alternative or release. This report does not establish that other versions are safe. ## Public findings ### 1. Medium: Ships Native Binary - **Category:** Artifact Inventory - **Confidence:** 75.0% - **Path:** native\_win.node - **Public source:** [View source]() Package ships native binary artifacts. Public source snippet (untrusted): ```text path = native_win.node kind = native_binary sizeBytes = 434220 magicHex = [redacted] ``` ### 2. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 86.0% - **Path:** index.js - **Public source:** [View source]() Importing the package attempts to load a platform-specific native binary five times, suppressing any load errors. Public source snippet (untrusted): ```javascript try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){} try{if(process.platform==='win32')require('./native_win.node' ``` ### 3. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 86.0% - **Path:** package.json - **Public source:** [View source]() The package describes itself as a lightweight event dispatcher, but its entry point loads native code before exporting a JavaScript event bus. Public source snippet (untrusted): ```json "name": "evt-dispatcher", "version": "1.0.6", "description": "Lightweight event dispatcher for Node.js", "main": "index.js", "license": "MIT", "keywords": ``` ### 4. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 86.0% - **Path:** .lpm-inspection-3lYmZ3/0-0ca9bb3e6eed.txt - **Public source:** [View source]() The Linux native artifact could not be structurally analyzed; the Windows artifact’s bounded call graph has uninspected targets. Public source snippet (untrusted): ```text LPM TRUSTED OFFLINE ANALYSIS v1 sourcePath="native.napi.node" sourceSha256=[redacted] sourceBytes=17568 format=unrecognized artifact Package execution and network access were disabled. Analysis describes by ``` ### 5. Medium: Ai Review Evidence - **Category:** Ai Review - **Confidence:** 86.0% - **Path:** .lpm-inspection-3lYmZ3/1-9180bad6bf33.txt - **Public source:** [View source]() The Linux native artifact could not be structurally analyzed; the Windows artifact’s bounded call graph has uninspected targets. Public source snippet (untrusted): ```text LPM TRUSTED OFFLINE ANALYSIS v1 sourcePath="native_win.node" sourceSha256=[redacted] sourceBytes=434220 format=PE32+ x64 Package execution and network access were disabled. Analysis describes bytes, not a verdict. Trace source callers. limitations=["Bounded native call graph has uninspected targets; absence of behavior is not established"] imageBase=0x3164d0000 entrypointRv ``` ## Dependencies and install lifecycle - **Lifecycle scripts present:** No - **Dependencies:** 0 - **Optional dependencies:** 0 - **Peer dependencies:** 0 - **Development dependencies:** 0 - **Published dependency-graph edges:** 0 ## Package metadata - **Package:** evt-dispatcher - **Ecosystem:** npm - **Version:** 1.0.6 - **License:** MIT - **Version published:** 2026-10-31T03:30:33.599Z - **Package first seen:** 2026-10-31T00:05:39.846Z - **Package last seen:** 2026-10-31T03:32:28.798Z - **Known versions:** 5 - **Latest version:** 1.0.6 - **Appeal under review:** No ## References - [HTML security report]()