registry / manager-thedate / 1.0.15

manager-thedate@1.0.15

AI Security Review

scanned 3h ago · by lpm-firewall-ai

The package exposes an opaque encrypted payload during normal module import. No execution, network access, or installation-time mutation is established.

Static reason

No blocking static signals were detected.

Trigger

A consumer imports manager-thedate.

Impact

The encrypted content is an inert staged payload in this version, but it cannot be audited from source.

Mechanism

Synchronously reads and exports an encrypted file as desKey.

Rationale

The package has no direct malicious execution chain, but its public API exposes an unauditable encrypted payload on import. Treat it as an inert staged payload carrier and warn rather than block.

Evidence

package.jsonindex.jsapps/docs/app/theta.jsapps/docs/app/des.db

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-15568

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in manager-thedate (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (0bf9e0992c5f44eca27aa54bf24603968476284ad050d4154affd6742f43a84f) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for block

The public entry point exports a value loaded from an encrypted database-named file.
Importing the package synchronously reads that opaque encrypted payload.
The packaged payload is base64-armored OpenSSL encrypted data, so its contents cannot be source-reviewed.

Evidence against

The root manifest has no preinstall, install, postinstall, or other lifecycle hook.
No network, shell execution, dynamic evaluation, credential harvesting, or file-writing code was found.
The encrypted payload is only read and exported; no decryption or execution path is present.

Behavioral surface

Source

Filesystem

Supply chain

UrlStrings

Manifest

NoLicense

scanned 15 file(s), 7.80 KB of source, external domains: github.com

Source & flagged code

2 flagged

index.jsView file

1export { desKey } from "./apps/docs/app/theta.js";

High

Ai Review Evidence

The public entry point exports a value loaded from an encrypted database-named file.

index.jsView on unpkg · L1

apps/docs/app/theta.jsView file

1import { readFileSync } from "node:fs"; import { fileURLToPath } from "node:url"; const desPath = fileURLToPath(new URL("./des.db", import.meta.url)); export const desKey = readFileSync(desPath, "utf8");

High

Ai Review Evidence

Importing the package synchronously reads that opaque encrypted payload.

apps/docs/app/theta.jsView on unpkg · L1

Source & flagged code

2 flagged · loading source

index.jsView file

1export { desKey } from "./apps/docs/app/theta.js";

High

Ai Review Evidence

The public entry point exports a value loaded from an encrypted database-named file.

index.jsView on unpkg · L1

apps/docs/app/theta.jsView file

High

Ai Review Evidence

Importing the package synchronously reads that opaque encrypted payload.

apps/docs/app/theta.jsView on unpkg · L1

Findings

2 High4 Low

HighAi Review Evidenceindex.js

HighAi Review Evidenceapps/docs/app/theta.js

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License