fast-url-utils@1.1.5
Fast URL parsing and manipulation utilities
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe Windows native module performs anti-debugging and process enumeration, writes to a temp file, and launches a child process during import. This concealed execution behavior is unrelated to the package’s stated URL utility purpose and supports blocking the package.
Static reason
No blocking static signals were detected.
Trigger
Import of index.js on Windows.
Impact
Unexpected execution of a child process and creation of a temp file when an application imports the package.
Mechanism
The native module checks for debugging, enumerates processes, writes a buffer to a temp-directory file, and launches a process with CreateProcessA. The native artifact’s analysis is bounded, so the launched process’s purpose is not fully established.
Attack narrative
On Windows, importing the package automatically loads native code that checks for analysis/debugging, inspects running processes, writes a buffer to a temp-directory file, and launches a process. This behavior is unrelated to URL utilities; the bounded artifact analysis does not establish the child process’s full purpose.
AI rationale
The Windows native module performs anti-debugging and process enumeration, writes to a temp file, and launches a child process during import. This concealed execution behavior is unrelated to the package’s stated URL utility purpose and supports blocking the package.
Evidence
index.js.lpm-inspection-GQi69y/1-85b6afd68b7c.txtnative_win.nodeWindows temp-directory file (constructed at runtime)
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The entry point loads the platform native module at import time, repeating the load five times and suppressing errors.
- The Windows native code checks debugger status and enumerates running processes before continuing.
- The Windows native code builds a path under the temp directory, opens a file there, and writes a buffer to it.
- The Windows native code calls CreateProcessA after constructing the temp-file path.
Evidence against
- The manifest has no lifecycle scripts or runtime dependencies.
- The JavaScript URL helper functions are ordinary parsing and query parameter utilities.
Behavioral surface
NativeBindings
Source & flagged code
5 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434124
magicHex = [redacted]
Medium
index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
tr
High
Ai Review Evidence
The entry point loads the platform native module at import time, repeating the load five times and suppressing errors.
index.jsView on unpkg · L1.lpm-inspection-GQi69y/1-85b6afd68b7c.txtView file
Findings
4 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-GQi69y/1-85b6afd68b7c.txt
HighAi Review Evidence.lpm-inspection-GQi69y/1-85b6afd68b7c.txt
HighAi Review Evidence.lpm-inspection-GQi69y/1-85b6afd68b7c.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to fast-url-utils@1.1.5.
See all versions of fast-url-utils for other recorded verdicts.
- Avoid installing fast-url-utils@1.1.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.