quickbuf
use latest
Fast native buffer operations: XOR, SHA-256, base64, constant-time compare, and CSPRNG
This report shows the evidence for quickbuf@1.0.6. 3 of 4 known versions are blocked or flagged. The newest version, 1.0.7, is flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThe native addon’s imported APIs and embedded anti-analysis/staging indicators are materially inconsistent with a buffer utility. The absence of install hooks does not mitigate import-time loading on Windows.
Static reason
No blocking static signals were detected.
Trigger
Runtime import/require of quickbuf on Windows.
Impact
Potential remote payload retrieval, process execution, and local file manipulation in the importing process context.
Mechanism
Native anti-analysis downloader/launcher behavior hidden behind a buffer API.
Attack narrative
index.js automatically loads the Windows native addon when the package is imported. That addon exposes the advertised buffer operations but also links HTTP client APIs, process enumeration and CreateProcessW, file deletion/enumeration, and embeds anti-analysis markers and executable staging paths. Those capabilities are not required for the package’s documented functionality and indicate concealed malware behavior.
AI rationale
The native addon’s imported APIs and embedded anti-analysis/staging indicators are materially inconsistent with a buffer utility. The absence of install hooks does not mitigate import-time loading on Windows.
Evidence
package.jsonindex.jsquickbuf.win32-x64-msvc.node
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- quickbuf.win32-x64-msvc.node imports WinHTTP request/read APIs despite the declared buffer-only API.
- The native binary imports process enumeration and CreateProcessW, unrelated to XOR/hash/base64 operations.
- Embedded strings include sandbox/debugger/malware-analysis indicators and Windows executable staging paths.
- The binary imports DeleteFileW and file-enumeration APIs; index.js loads it during package import on Windows.
Evidence against
- package.json has no lifecycle scripts.
- index.js fallback implementation only performs documented buffer and crypto operations.
- The exported Node-API function names match the documented buffer API.
Behavioral surface
CryptoDynamicRequire
Source & flagged code
2 flagged · loading sourceindex.jsView file
2L3: var path = require('path');
L4: var native;
Medium
quickbuf.win32-x64-msvc.nodeView file
•path = quickbuf.win32-x64-msvc.node
kind = native_binary
sizeBytes = 253952
magicHex = [redacted]
Medium
Findings
2 Medium
MediumDynamic Requireindex.js
MediumShips Native Binaryquickbuf.win32-x64-msvc.node
Affected versions and remediation
This report applies to quickbuf@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing quickbuf@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.