AI Security Review
scanned 2h ago · by lpm-firewall-aiNo executable package attack surface is established. The only unusual content is an inert opaque binary blob stored in the manifest description.
Static reason
No blocking static signals were detected.
Trigger
Package metadata read or registry display only; no install-time or runtime entrypoint is declared.
Impact
No source path executes, writes files, accesses credentials, or makes network requests.
Mechanism
Opaque inert payload carrier in manifest metadata.
Rationale
The manifest blob is abnormal and unexplained, but it has no observed execution or delivery mechanism. This merits a warning rather than a block.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- `package.json` contains a 682,668-character opaque base64 description blob.
- Decoded description is high-entropy binary data, not a normal package description.
- The package has no functional source: `index.js` is empty.
Evidence against
- `package.json` declares no lifecycle scripts.
- `package.json` declares no entrypoint, bin, dependencies, or optional dependencies.
- No executable source, network endpoint, shell invocation, credential access, or file-write logic was found.
Behavioral surface
Trivial
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
•Published source reference
Medium
Ai Review Evidence
`package.json` contains a 682,668-character opaque base64 description blob.
package.jsonView on unpkgFindings
3 Medium
MediumAi Review Evidencepackage.json
MediumAi Review Evidence
MediumAi Review Evidence