registry  /  node-fsagent  /  4.685.45

node-fsagent@4.685.45

chunk 4.685.45

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No executable attack path is established: installation has no lifecycle hook and the only JavaScript file is empty. The package does carry unexplained opaque data that could become a staged payload only if another package consumes it.

Static reason
No blocking static signals were detected.
Trigger
A separate consumer would need to read and decode the package metadata.
Impact
No direct package-local impact confirmed; opaque metadata presents unresolved staging risk.
Mechanism
Inert opaque data carrier with no local execution path.
Rationale
No concrete malicious execution behavior is present, so blocking is not justified. The unexplained encoded metadata makes this an inert staged-payload carrier and warrants a warning.
Evidence
package.jsonindex.js

Decision evidence

public snapshot
AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
  • `package.json` contains ~69 KB of opaque high-entropy strings in `keywords`.
  • The package description is `chunk 4.685.45`, consistent with data packaging rather than a functional module.
Evidence against
  • `package.json` defines no lifecycle scripts, entrypoints, bin, or dependencies.
  • `index.js` exists but is empty.
  • No source code, network endpoints, credential access, shell execution, or file mutation was found.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chain
Trivial
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 0 B of source

Source & flagged code

1 flagged · loading source
package.jsonView file
•Published source reference
Medium
Ai Review Evidence

`package.json` contains ~69 KB of opaque high-entropy strings in `keywords`.

package.jsonView on unpkg

Findings

2 Medium
MediumAi Review Evidencepackage.json
MediumAi Review Evidence