AI Security Review
scanned 3h ago · by lpm-firewall-aiNo install-time or runtime code path is present. The package distributes an opaque encoded binary blob solely through manifest keywords, creating an inert staged-payload risk.
Static reason
No blocking static signals were detected.
Trigger
Package installation or metadata retrieval exposes the embedded payload; no package code trigger exists.
Impact
No direct execution is established; the payload could be consumed by an external loader or later package version.
Mechanism
Opaque binary payload embedded in npm metadata.
Rationale
Direct inspection found an empty code file and no execution entrypoints, but a deliberately encoded opaque payload in package metadata. Treat it as suspicious rather than malicious because no concrete activation chain is present.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json stores 274 base64-shaped keyword fragments totaling 68,268 characters.
- Concatenated keyword data decodes to opaque high-entropy binary, not a recognized format.
- package description is "chunk 4.685.68", consistent with a data carrier rather than a filesystem agent.
Evidence against
- package.json has no lifecycle scripts, entrypoints, bin, exports, or dependencies.
- index.js exists but is empty (0 bytes).
- No executable source, network endpoint, file harvesting, shell, or persistence mechanism is present.
Behavioral surface
Trivial
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
•Published source reference
Medium
Ai Review Evidence
package.json stores 274 base64-shaped keyword fragments totaling 68,268 characters.
package.jsonView on unpkgFindings
3 Medium
MediumAi Review Evidencepackage.json
MediumAi Review Evidence
MediumAi Review Evidence