registry / node-fsagent / 4.685.72

node-fsagent@4.685.72

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No executable install- or runtime attack chain is present. package.json carries opaque binary data in metadata that could be consumed externally, but no consumer exists in this package.

Static reason

No blocking static signals were detected.

Trigger

Package metadata is read or an external tool reassembles the keyword chunks.

Impact

No direct package-side impact is confirmed; the hidden data is an unresolved inert payload carrier.

Mechanism

Opaque payload staging in package metadata.

Rationale

The package is non-executable but embeds concealed binary-like content in npm metadata. Treat it as an inert staged-payload carrier rather than a confirmed active compromise.

Evidence

package.jsonindex.js

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

package.json contains 274 opaque base64-like keyword chunks.
Decoded samples are high-entropy binary without recognizable text or file headers.
The package is described as a "chunk", consistent with metadata payload staging.

Evidence against

index.js exists but is empty.
package.json has no lifecycle scripts, main, bin, dependencies, or optional dependencies.
No executable source, network endpoint, credential access, file writes, or shell execution was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 0 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json contains 274 opaque base64-like keyword chunks.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json contains 274 opaque base64-like keyword chunks.

package.jsonView on unpkg

Findings

3 Medium

MediumAi Review Evidencepackage.json

MediumAi Review Evidence