AI Security Review
scanned 2h ago · by lpm-firewall-aiNo executable attack chain is present. `package.json` nevertheless embeds an opaque binary payload in metadata, making the package an inert payload carrier.
Static reason
No blocking static signals were detected.
Trigger
Package metadata inspection or a future consumer that extracts `keywords`.
Impact
No current runtime impact is established; the hidden payload creates unresolved supply-chain risk.
Mechanism
Opaque base64-encoded binary payload stored in manifest keywords.
Rationale
The source has no active malicious behavior, but a large opaque binary payload hidden in manifest keywords has no package-aligned purpose. Warn rather than block because it is inert in this version.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- `package.json` stores 274 opaque base64-like keyword strings totaling 68,268 characters.
- Concatenated keywords decode to unrecognized high-entropy binary data with no readable format header.
- The package has no functional source that explains or consumes this embedded payload.
Evidence against
- `package.json` has no lifecycle scripts, dependencies, bin, main, module, browser, or types entries.
- `index.js` exists but is empty; package import has no observable behavior.
- No network endpoints, shell/process APIs, file writes, dynamic loading, or credential access appear in package files.
Behavioral surface
Trivial
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
•Published source reference
Medium
Ai Review Evidence
`package.json` stores 274 opaque base64-like keyword strings totaling 68,268 characters.
package.jsonView on unpkgFindings
3 Medium
MediumAi Review Evidencepackage.json
MediumAi Review Evidence
MediumAi Review Evidence