registry / node-fsagent / 4.685.70

node-fsagent@4.685.70

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No executable attack path is present in the extracted package. `package.json` carries opaque binary material encoded in metadata, making this an inert staged-payload carrier.

Static reason

One or more suspicious static signals were detected.

Trigger

No package action triggers the opaque data; an external consumer would be required.

Impact

No direct impact is established from this package alone; concealed payload material creates unresolved supply-chain risk.

Mechanism

Opaque base64 payload staged in package metadata.

Rationale

Direct inspection found no executable malicious behavior, but the intentionally opaque metadata payload is a real unresolved supply-chain risk. Downgrade to a warning rather than block because no activation or harmful action is implemented.

Evidence

package.jsonindex.js

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

`package.json` stores 274 long base64-like chunks in `keywords`.
Concatenated keyword data decodes to opaque high-entropy binary data.
The opaque data is unrelated to declared package metadata or functionality.

Evidence against

`package.json` has no lifecycle scripts, bin, dependencies, or explicit entrypoints.
`index.js` exists but is empty.
No source code, network endpoints, credential access, shell execution, or file mutation is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 0 B of source

Source & flagged code

2 flagged

package.jsonView file

1patternName = google_api_key severity = high line = 1 matchedText = {"name":...="]}

High

High Secret

Package contains a high-severity secret pattern.

package.jsonView on unpkg · L1

1patternName = google_api_key severity = high line = 1 matchedText = {"name":...="]}

High

Secret Pattern

Google API key in package.json

package.jsonView on unpkg · L1

Source & flagged code

2 flagged · loading source

package.jsonView file

1patternName = google_api_key severity = high line = 1 matchedText = {"name":...="]}

High

High Secret

Package contains a high-severity secret pattern.

package.jsonView on unpkg · L1

1patternName = google_api_key severity = high line = 1 matchedText = {"name":...="]}

High

Secret Pattern

Google API key in package.json

package.jsonView on unpkg · L1

Findings

2 High

HighHigh Secretpackage.json

HighSecret Patternpackage.json