AI Security Review
scanned 2h ago · by lpm-firewall-aiNo executable install-time or runtime attack surface is established. The package is an inert opaque-data carrier with no declared entrypoint or lifecycle hook.
Static reason
No blocking static signals were detected.
Trigger
None identified from package metadata or source.
Impact
No confirmed execution path; payload provenance and purpose remain unresolved.
Mechanism
Opaque binary payload stored in package metadata only.
Rationale
No concrete malicious behavior or activation path is present, but the inert opaque payload is abnormal and cannot be attributed to a benign package function.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- package.json contains a 682668-character opaque base64-like description that decodes to unclassified binary data.
- package contains no usable source: index.js is empty and package.json has no entrypoint metadata.
Evidence against
- package.json defines no preinstall, install, postinstall, or other lifecycle scripts.
- No bin, main, module, browser, dependencies, or optional dependencies are declared.
- No executable JavaScript, network endpoint, credential access, shell execution, or file mutation was found in inspected files.
Behavioral surface
Trivial
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•Published source reference
Medium
Ai Review Evidence
package.json contains a 682668-character opaque base64-like description that decodes to unclassified binary data.
package.jsonView on unpkg•Published source reference
Medium
Ai Review Evidence
package contains no usable source: index.js is empty and package.json has no entrypoint metadata.
package.jsonView on unpkgFindings
2 Medium
MediumAi Review Evidencepackage.json
MediumAi Review Evidencepackage.json