registry / node-fsagent / 4.685.87

node-fsagent@4.685.87

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No executable attack path is established. The manifest contains an inert opaque binary payload hidden in metadata, which is anomalous and could be staged for later use outside this package.

Static reason

No blocking static signals were detected.

Trigger

No install-time or runtime trigger is present.

Impact

No direct package-side execution or exfiltration is confirmed.

Mechanism

Opaque binary payload embedded in `keywords` metadata.

Rationale

Static source inspection found no concrete malicious execution chain, but the unexplained encoded binary metadata is an inert payload carrier. Downgrade to warn for supply-chain risk.

Evidence

package.jsonindex.js

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

`package.json` stores 274 opaque Base64-like keyword strings totaling 68,268 characters.
Concatenated keyword data decodes to 51,201 bytes of unrecognized high-entropy binary data.
`index.js` is empty, so the package supplies no inspectable runtime implementation.

Evidence against

`package.json` has no `scripts` lifecycle hooks.
Manifest has no `main`, `bin`, `module`, `browser`, dependencies, or optional dependencies.
No network endpoint, credential access, shell execution, file mutation, or loader code is present in packaged files.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 0 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

`package.json` stores 274 opaque Base64-like keyword strings totaling 68,268 characters.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

Medium

Ai Review Evidence

`package.json` stores 274 opaque Base64-like keyword strings totaling 68,268 characters.

package.jsonView on unpkg

Findings

3 Medium

MediumAi Review Evidencepackage.json

MediumAi Review Evidence