registry / quickbuf / 1.0.5

quickbuf@1.0.5

Fast native buffer operations: XOR, SHA-256, base64, constant-time compare, and CSPRNG

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Installation invokes the package, which imports a Windows native addon. The addon contains download, process-launch, process-enumeration, and file-cleanup primitives inconsistent with buffer acceleration.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall on installation; also any runtime import on Windows x64.

Impact

Potential payload download/execution and stealthy persistence or cleanup on Windows hosts.

Mechanism

silent native-addon execution with network, evasion, and process-launch capability

Attack narrative

The postinstall script suppresses errors while requiring the package, causing index.js to load the Windows native addon. That addon contains WinHTTP request functions, CreateProcessW, process enumeration, anti-analysis markers, Zone.Identifier handling, and executable-looking LOCALAPPDATA/TEMP paths. These capabilities are unrelated to the declared buffer API and establish an install-time native malware chain.

Rationale

The documented JavaScript utility code is benign, but the silently invoked native binary carries concrete network, evasion, file-cleanup, and process-execution behavior inconsistent with its stated purpose. This is malicious install-time behavior.

Evidence

package.jsonindex.jsquickbuf.win32-x64-msvc.node

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with false-positive risk.

quickbuf@1.0.5

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code