registry / fast-url-utils / 1.1.1
fast-url-utils@1.1.1
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Windows addon executes concealed cache data automatically during import and includes anti-analysis behavior, which is suspicious and unrelated to URL utilities. The available evidence does not establish what the payload does, so this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.
Trigger
Requiring the package on Windows loads `native_win.node` immediately.
Impact
Automatically executing an undisclosed payload is unrelated to the stated URL utility purpose; its specific effects remain unknown.
Mechanism
The addon checks for debugger and analysis conditions, reads `.napi_cache`, XOR-decodes its contents, writes a file in the Windows temporary directory, and starts a process. The decoded payload was not available for inspection.
AI rationale
The Windows addon executes concealed cache data automatically during import and includes anti-analysis behavior, which is suspicious and unrelated to URL utilities. The available evidence does not establish what the payload does, so this warrants a warning rather than a malicious verdict.
Evidence
index.jsnative_win.node.napi_cache.lpm-inspection-Fs4aAH/1-86785e65f9b2.txtWindows temporary directory (generated file path)
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The entry point synchronously loads a platform-specific native addon during import.
- The Windows addon checks for debugger and analysis conditions and enumerates running processes before proceeding.
- The addon reads adjacent `.napi_cache` data, XOR-decodes it, writes a temporary file, and starts a process using `CreateProcessA`; the payload’s purpose could not be established.
Evidence against
- The package describes itself as a URL parsing and manipulation utility and exports URL helper functions.
- The manifest declares no lifecycle scripts or dependencies.
- The Linux native artifact’s behavior could not be determined from the available analysis.
Behavioral surface
NativeBindings
Source & flagged code
8 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434190
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
'use strict';
function parseUrl(url) {
Medium
Ai Review Evidence
The entry point synchronously loads a platform-specific native addon during import.
index.jsView on unpkg · L1.lpm-inspection-Fs4aAH/1-86785e65f9b2.txtView file
7313164d16f9: ff 15 09 cc 00 00 call qword ptr [rip + 0xcc09] # 0x3164de308 <__imp_IsDebuggerPresent> ; KERNEL32.dll!IsDebuggerPresent
3164d16ff: 85 c0 test eax, eax
3164d1701: 75 93 jne 0x3164d1696 <Run.co
Findings
8 Medium
MediumShips Native Binarynative_win.node
MediumAi Review Evidenceindex.js
MediumAi Review Evidence.lpm-inspection-Fs4aAH/1-86785e65f9b2.txt
MediumAi Review Evidence.lpm-inspection-Fs4aAH/1-86785e65f9b2.txt
MediumAi Review Evidence.lpm-inspection-Fs4aAH/1-86785e65f9b2.txt
MediumAi Review Evidence.lpm-inspection-Fs4aAH/1-86785e65f9b2.txt
MediumAi Review Evidence.lpm-inspection-Fs4aAH/1-86785e65f9b2.txt
MediumAi Review Evidence.lpm-inspection-Fs4aAH/1-86785e65f9b2.txt
Affected versions and remediation
This report applies to fast-url-utils@1.1.1.
See all versions of fast-url-utils for other recorded verdicts.
- Review the evidence and your use of fast-url-utils@1.1.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.