registry / nonenull1 / 1.1.0

nonenull1@1.1.0

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package contains a build-time execution hook in binding.gyp, but it targets an empty index.js file.

Static reason

No blocking static signals were detected.

Trigger

npm install on environments that invoke node-gyp for gypfile packages

Impact

No observed payload or side effect beyond a no-op Node process.

Mechanism

empty build-time Node invocation via binding.gyp

Rationale

Source inspection shows an install/build execution primitive, but the executed file is empty and there are no exfiltration, mutation, persistence, or remote execution behaviors. The scanner manifest/build-helper hints do not map to a concrete malicious chain in the extracted source.

Evidence

package.jsonbinding.gypindex.js

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

binding.gyp uses gyp shell expansion to run `node index.js` during native build evaluation if node-gyp runs.

Evidence against

package.json has no explicit lifecycle scripts, dependencies, bin, or network configuration.
index.js is 0 bytes, so the build-time `node index.js` command has no payload.
Only package files present are package.json, binding.gyp, and empty index.js.
No source references to network, credential/env harvesting, filesystem writes, child_process, eval, native binaries, or persistence.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

Manifest

NoLicense

scanned 1 file(s), 0 B of source

Source & flagged code

2 flagged

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 174 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

package.jsonView file

•scripts registry_only=install

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Source & flagged code

2 flagged · loading source

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 174 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

package.jsonView file

•scripts registry_only=install

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

1 Critical1 Medium1 Low

CriticalManifest Confusionpackage.json

MediumShips Build Helperbinding.gyp

LowNo License