registry / redis-type-intel / 1.10.6

redis-type-intel@1.10.6

TypeScript-based Node.js library for Redis with object mapping and additional utilities.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package resolves the malicious ulid-intel runtime dependency. The shipped entrypoint is absent, while copied documentation points to another package.

Static reason

No blocking static signals were detected.

Trigger

npm installs redis-type-intel or resolves its production dependencies.

Impact

Dependency installation can introduce attacker-controlled code into the consumer project.

Mechanism

Malicious runtime dependency insertion behind an inconsistent package identity.

Attack narrative

The package declares ulid-intel as a production dependency despite presenting itself as a Redis object-mapping library. That dependency is independently flagged as malicious. The absent declared dist entrypoint and README references to redis-type-os further indicate a repackaged or deceptive publication, so normal dependency installation is the effective delivery path.

Rationale

The malicious production dependency is sufficient for a supply-chain compromise even without a lifecycle script. Manifest and README inconsistencies reinforce that this is not a coherent benign release.

Evidence

package.jsonREADME.mdnode_modules/ulid-intel

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

redis-type-intel@1.10.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code