fast-url-utils@1.1.4
Fast URL parsing and manipulation utilities
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically runs a native routine on import that decodes a bundled cache file and launches the result as a hidden Node script. This is concealed execution unrelated to the package's stated URL utility purpose, so the package is malicious.
Static reason
No blocking static signals were detected.
Trigger
Importing the package on Windows.
Impact
Runs concealed code under the user's account; the script's further behavior could not be established from the available binary view.
Mechanism
The native module reads .napi_cache, XOR-decodes the bytes, writes a temporary .js file, marks it hidden, and starts it with Node.
Attack narrative
On Windows, importing this package loads a native module that reads and XOR-decodes the bundled .napi_cache file, writes the result as a hidden temporary JavaScript file, and launches it with Node. The payload's further behavior is unresolved, but its concealed automatic execution is unrelated to URL utilities.
AI rationale
The package automatically runs a native routine on import that decodes a bundled cache file and launches the result as a hidden Node script. This is concealed execution unrelated to the package's stated URL utility purpose, so the package is malicious.
Evidence
index.jsnative_win.node.napi_cache.lpm-inspection-O4D0TG/1-da7956a367d8.txt%TEMP%\.nc<PID>.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing index.js loads the platform-specific native module automatically.
- The Windows native module calls its Run routine during module registration.
- Run reads .napi_cache and XOR-decodes its contents.
- The decoded contents are written to a temporary script, marked hidden, and launched with Node.
Evidence against
- The manifest declares no install lifecycle scripts.
- The JavaScript API provides URL parsing and manipulation utilities.
Behavioral surface
NativeBindings
Source & flagged code
9 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434257
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node'
High
Ai Review Evidence
Importing index.js loads the platform-specific native module automatically.
index.jsView on unpkg · L1.lpm-inspection-O4D0TG/1-da7956a367d8.txtView file
569sub rsp, 0x48
3164d1be8: 49 89 d5 mov r13, rdx
3164d1beb: 49 89 cc mov r12, rcx
3164d1bee: e8 2d f9 ff ff call 0x3164d1520 <Run.constprop.0.isra.0>
3164d1bf3: 48 8d 44 24 38
Findings
8 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
HighAi Review Evidence.lpm-inspection-O4D0TG/1-da7956a367d8.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to fast-url-utils@1.1.4.
See all versions of fast-url-utils for other recorded verdicts.
- Avoid installing fast-url-utils@1.1.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.