registry / mkb-manager / 1.0.11

mkb-manager@1.0.11

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Importing the root package synchronously reads and exposes an opaque encrypted payload. No in-package execution or exfiltration chain is present.

Static reason

No blocking static signals were detected.

Trigger

Runtime import of mkb-manager.

Impact

A consumer could later decrypt or use the opaque payload, but this package contains no such stage.

Mechanism

Import-time export of an encrypted payload carrier.

Rationale

The package does not perform a concrete malicious action, but its import-time delivery of an undocumented encrypted blob is not package-aligned and cannot be meaningfully audited from source.

Evidence

package.jsonindex.jsapps/docs/app/theta.jsapps/docs/app/des.dbapps/docs/package.json

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14490

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mkb-manager (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (299f162cc2ff57788cc4ebadedda746bfd504ac2a63fb53a3789a53c2e1881c9) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for block

index.js exports desKey from apps/docs/app/theta.js.
apps/docs/app/theta.js synchronously reads des.db on package import.
apps/docs/app/des.db is a 16,684-byte OpenSSL salted, base64-encrypted blob.
The encrypted blob is the package's only exported value and has no documented purpose.
apps/docs/package.json names absent theta.ts/data.db instead of shipped theta.js/des.db.

Evidence against

Root package.json has no preinstall, install, or postinstall hook.
No source path executes, decrypts, or evaluates the blob.
No network, child-process, environment harvesting, or file-write logic was found.

Behavioral surface

Source

Filesystem

Supply chain

UrlStrings

Manifest

NoLicense

scanned 15 file(s), 7.78 KB of source, external domains: github.com

Source & flagged code

3 flagged

apps/docs/app/theta.jsView file

•Published source reference

High

Ai Review Evidence

index.js exports desKey from apps/docs/app/theta.js.

apps/docs/app/theta.jsView on unpkg

•Published source reference

High

Ai Review Evidence

apps/docs/app/theta.js synchronously reads des.db on package import.

apps/docs/app/theta.jsView on unpkg

package.jsonView file

•Published source reference

High

Ai Review Evidence

apps/docs/package.json names absent theta.ts/data.db instead of shipped theta.js/des.db.

package.jsonView on unpkg

Source & flagged code

3 flagged · loading source

apps/docs/app/theta.jsView file

•Published source reference

High

Ai Review Evidence

index.js exports desKey from apps/docs/app/theta.js.

apps/docs/app/theta.jsView on unpkg

•Published source reference

High

Ai Review Evidence

apps/docs/app/theta.js synchronously reads des.db on package import.

apps/docs/app/theta.jsView on unpkg

package.jsonView file

•Published source reference

High

Ai Review Evidence

apps/docs/package.json names absent theta.ts/data.db instead of shipped theta.js/des.db.

package.jsonView on unpkg

Findings

5 High4 Low

HighAi Review Evidenceapps/docs/app/theta.js

HighAi Review Evidence

HighAi Review Evidencepackage.json

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License