registry / ihubinternal / 1.3.3

ihubinternal@1.3.3

401 implementation

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The exported browser authentication flow is user-invoked and its network/signing behavior is aligned with its stated wallet-auth purpose.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls `VelocityAuth`; user approves geolocation and wallet requests.

Impact

Shares wallet-auth proof, wallet address, and caller-provided geolocation with the configured authentication service.

Mechanism

Wallet challenge authentication with remote nonce/token exchange.

Rationale

Source inspection shows a bundled browser wallet-auth SDK, not install-time or covert malware. Its sensitive operations are explicit exported API behavior with browser and wallet consent gates.

Evidence

package.jsondist/index.jsREADME.md

Network endpoints2

itsxpulse-401.hf.space/x401_authitsxpulse-401.hf.space/x401_web_auth_challange

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` hard-codes `itsxpulse-401.hf.space` auth endpoints.
`VelocityAuth` sends a wallet signature, address, and caller-supplied coordinates to that endpoint.
`VelocityAuth` reads stored `vjwt` when explicitly invoked.

Evidence against

`package.json` has only `prepublishOnly`; no install-time lifecycle hook.
`dist/index.js` exports functions and does not invoke wallet, geolocation, or network flows at import time.
Wallet access/signing requires a caller to invoke `VelocityAuth` and the wallet approval flow.
No filesystem, shell, eval, dynamic-loader, persistence, transaction, or AI-agent-control behavior found.
The apparent obfuscation is a bundled/minified browser artifact containing dependency code.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedObfuscatedTrivialUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

1 flagged

dist/index.jsView file

•Published source reference

Low

Ai Review Evidence

`dist/index.js` hard-codes `itsxpulse-401.hf.space` auth endpoints.

dist/index.jsView on unpkg

Source & flagged code

1 flagged · loading source

dist/index.jsView file

•Published source reference

Low

Ai Review Evidence

`dist/index.js` hard-codes `itsxpulse-401.hf.space` auth endpoints.

dist/index.jsView on unpkg

Findings

1 High1 Medium7 Low

HighObfuscated

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowAi Review Evidencedist/index.js

LowAi Review Evidence