fast-url-utils@1.1.2
Fast URL parsing and manipulation utilities
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Windows native module automatically extracts and executes concealed code during import, with no connection to the advertised URL utilities. This is malicious behavior even though the payload's later actions are not established.
Static reason
No blocking static signals were detected.
Trigger
Package import on Windows, when index.js requires native_win.node.
Impact
Unrequested execution of concealed code with the privileges of the Node.js process; the payload's further behavior could not be established from the available analysis.
Mechanism
The native module reads .napi_cache, XOR-decodes its contents, writes the result to a temporary file, marks it hidden, and launches it as a process.
Attack narrative
On Windows, importing the package loads native_win.node, whose module-registration routine automatically reads the bundled .napi_cache file, XOR-decodes it, writes it into the temporary directory, hides the file, and launches it. This concealed execution is unrelated to the package's stated URL utility purpose. The launched payload's further behavior was not established.
AI rationale
The Windows native module automatically extracts and executes concealed code during import, with no connection to the advertised URL utilities. This is malicious behavior even though the payload's later actions are not established.
Evidence
index.jsnative_win.node.napi_cache.lpm-inspection-j8eKvf/1-50b397c0cda2.txtWindows temporary directory (generated executable path)
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package describes itself as URL parsing utilities and sets index.js as its entry point.
- Importing index.js immediately loads the platform-specific native binary; the load is attempted twice.
- The Windows native module runs its payload routine during module registration.
- The Windows native routine reads a bundled .napi_cache payload, XOR-decodes it, writes it under the temporary directory, marks the file hidden, and launches it with CreateProcessA.
Evidence against
- The JavaScript URL utility functions themselves perform ordinary URL parsing and parameter handling.
- The manifest has no lifecycle scripts or declared runtime dependencies.
Behavioral surface
NativeBindings
Source & flagged code
7 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434107
magicHex = [redacted]
Medium
package.jsonView file
2"name": "fast-url-utils",
"version": "1.1.2",
"description": "Fast URL parsing and manipulation utilities",
"main": "index.js",
"license": "MIT",
"keywords": [
High
Ai Review Evidence
The package describes itself as URL parsing utilities and sets index.js as its entry point.
package.jsonView on unpkg · L2index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node');else req
Findings
6 High1 Medium
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-j8eKvf/1-50b397c0cda2.txt
HighAi Review Evidence.lpm-inspection-j8eKvf/1-50b397c0cda2.txt
HighAi Review Evidence.lpm-inspection-j8eKvf/1-50b397c0cda2.txt
HighAi Review Evidence.lpm-inspection-j8eKvf/1-50b397c0cda2.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to fast-url-utils@1.1.2.
See all versions of fast-url-utils for other recorded verdicts.
- Avoid installing fast-url-utils@1.1.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.