registry / node-fsagent / 4.685.74

node-fsagent@4.685.74

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No executable attack path is established. package.json embeds a large opaque binary payload in keywords, but the package has no lifecycle hook or runtime entrypoint to activate it.

Static reason

No blocking static signals were detected.

Trigger

None established; npm metadata parsing only.

Impact

No confirmed execution, exfiltration, persistence, or destructive behavior; payload could be activated only by external code not present in this package.

Mechanism

Inert opaque payload stored in manifest keywords.

Rationale

No active malicious behavior is reachable from this package, but the unexplained opaque payload is a concrete supply-chain risk indicator. Warn rather than block because there is no install-time or runtime execution path.

Evidence

package.jsonindex.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

package.json contains 274 opaque base64-like keyword entries totaling 68,268 characters.
Concatenated keyword data decodes to high-entropy binary with no readable format/header.
The opaque metadata blob is an inert payload carrier with no in-package loader.

Evidence against

package.json has no lifecycle scripts, entrypoints, bin, dependencies, or exports.
index.js exists but is empty (0 bytes).
No executable package source references the metadata blob, performs network access, or accesses files, environment, shells, or dynamic code.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 0 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json contains 274 opaque base64-like keyword entries totaling 68,268 characters.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

package.json contains 274 opaque base64-like keyword entries totaling 68,268 characters.

package.jsonView on unpkg

Findings

3 Medium

MediumAi Review Evidencepackage.json

MediumAi Review Evidence