AI Security Review
scanned 2h ago · by lpm-firewall-aiNo executable install-time or runtime attack path is established. The sole suspicious artifact is inert opaque binary embedded in package metadata.
Static reason
No blocking static signals were detected.
Trigger
None; no lifecycle hook, entrypoint, or bin is declared.
Impact
No confirmed file access, execution, persistence, credential collection, or exfiltration.
Mechanism
Inert opaque metadata payload
Rationale
Opaque binary metadata is anomalous and unsupported by package function, but direct inspection found no activation mechanism or concrete malicious behavior. Warn rather than block for an inert payload carrier.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- `package.json` stores a 682744-byte opaque base64 description payload.
- Decoded description begins as high-entropy binary data, not package metadata.
Evidence against
- `package.json` has only name, version, license, and description fields.
- No preinstall/install/postinstall or other lifecycle scripts are defined.
- No main, module, browser, bin, dependencies, or optional dependencies are declared.
- `index.js` exists but is empty; package exposes no executable source.
Behavioral surface
Trivial
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
•Published source reference
Medium
Ai Review Evidence
`package.json` stores a 682744-byte opaque base64 description payload.
package.jsonView on unpkgFindings
2 Medium
MediumAi Review Evidencepackage.json
MediumAi Review Evidence