registry  /  md-components-mdigial-azamat  /  0.0.312

md-components-mdigial-azamat@0.0.312

npm version patch npm run build npm publish

AI Security Review

scanned 5d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a bundled React component library with browser-only UI/network behavior and a calculator formula evaluator.

Static reason
High-risk behavior combination matched malicious policy.
Trigger
Importing or rendering exported React components; prepare: husky only during development/package preparation contexts.
Impact
No credential harvesting, persistence, destructive behavior, install-time payload, or AI-agent control hijack identified.
Mechanism
UI components with product API fetches and component-configured formula evaluation
Rationale
Static inspection found suspicious primitives, but they are consistent with a frontend component library: browser fetches, local/session storage for app language or auth token, and formula evaluation for a custom calculator. No lifecycle install payload, exfiltration, persistence, filesystem mutation, or agent-control-surface modification was found.
Evidence
package.jsondist/main.jsdist/CustomCalculator/hooks/useCalculator.jsdist/ModuleArm/components/MediaUrlField.jsdist/clientApi-ccb08ba6.jsdist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.js
Network endpoints5
mbank.kg/constructor-apimbank.kg/api/murabaha.mbank.kg/callback/api/v1/percent/currency/kgsmurabaha.mbank.kg/callback/api/v1/percent/currency/usdwww.google.com/recaptcha/api.js

Decision evidence

public snapshot
AI called this Clean at 90.0% confidence as Benign with low false-positive risk.
Evidence for block
    Evidence against
    • package.json only declares prepare: husky and files: dist; no postinstall/preinstall/install script or bin entrypoint.
    • dist/main.js is a React component barrel exporting UI modules, not an import-time payload.
    • new Function in dist/CustomCalculator/hooks/useCalculator.js compiles configured calculator formulas from component data and is invoked at runtime by the calculator.
    • Network use is product-aligned browser fetches to mbank.kg/constructor-api, mbank.kg/api, murabaha.mbank.kg, recaptcha, and user-supplied URLs.
    • No fs/child_process/native loading or project/home/AI-agent control-surface writes found in inspected sources.
    • Trojan-source hint in NewsBodyRichTextEditor.js appears to be bundled ProseMirror/Tiptap code and Unicode NBSP/non-ASCII domain data, not hidden control-flow manipulation.
    Behavioral surface
    Source
    ChildProcessEnvironmentVarsEvalNetwork
    Supply chain
    HighEntropyStringsMinifiedUrlStrings
    Manifest
    NoLicense
    scanned 853 file(s), 2.74 MB of source, external domains: api.example.com, api.whatsapp.com, app.mbank.kg, apps.apple.com, cdn-icons-png.flaticon.com, cdn.tailwindcss.com, developer.mozilla.org, example.com, facebook.com, fb.me, github.com, hub.mbank.kg, images.unsplash.com, img.youtube.com, instagram.com, linkedin.com, mbank.kg, murabaha.mbank.kg, picsum.photos, play.google.com, prosemirror.net, s-c.sh, styled-components.com, t.me, upload.wikimedia.org, w3c.github.io, wallpapercave.com, www.google.com, www.styled-components.com, www.w3.org, www.youtube.com

    Source & flagged code

    3 flagged · loading source
    dist/CustomCalculator/hooks/useCalculator.jsView file
    204try { L205: t[e.id] = new Function(...n, `return ${e.expression}`); L206: } catch {
    Low
    Eval

    Package source references a known benign dynamic code generation pattern.

    dist/CustomCalculator/hooks/useCalculator.jsView on unpkg · L204
    dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView file
    1557contains invisible/control Unicode U+200B (zero width space) Get the _n_<U+200B>th outgoing edge from this node in the finite
    Critical
    Trojan Source Unicode

    Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

    dist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.jsView on unpkg · L1557
    dist/assets/Inter-Medium.woff2View file
    •path = dist/assets/Inter-Medium.woff2 kind = high_entropy_blob sizeBytes = 108096 magicHex = [redacted]
    High
    Ships High Entropy Blob

    Package ships high-entropy non-source blobs.

    dist/assets/Inter-Medium.woff2View on unpkg

    Findings

    1 Critical1 High3 Medium6 Low
    CriticalTrojan Source Unicodedist/Modules/News/arm/detail-form/NewsBodyRichTextEditor.js
    HighShips High Entropy Blobdist/assets/Inter-Medium.woff2
    MediumNetwork
    MediumEnvironment Vars
    MediumStructural Risk Force Deep Review
    LowNon Install Lifecycle Scripts
    LowScripts Present
    LowEvaldist/CustomCalculator/hooks/useCalculator.js
    LowHigh Entropy Strings
    LowUrl Strings
    LowNo License