registry / render-keepalive / 1.0.5
render-keepalive@1.0.5
AI Security Review
scanned 11d ago · by lpm-firewall-aiThe network behavior is reachable only through the exported runtime function and matches the package description of notices and a one-time environment snapshot. The inspected snapshot sends system metadata and environment variable names, with no evidence of credential or environment-value transfer.
Static reason
One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review
Trigger
A consumer calls startKeepAlive; the snapshot runs unless RK_SNAPSHOT is set to off or a prior snapshot is recorded.
Impact
The snapshot shares system metadata and environment variable names; inspected source does not send environment variable values or credentials.
Mechanism
The package posts system metadata and environment variable names to ntfy.sh using a configurable topic with a built-in default.
AI rationale
The network behavior is reachable only through the exported runtime function and matches the package description of notices and a one-time environment snapshot. The inspected snapshot sends system metadata and environment variable names, with no evidence of credential or environment-value transfer.
Evidence
index.jslib/collect.js
Network endpoints1
ntfy.sh
Decision evidence
public snapshotAI called this Clean at 91.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package describes wake and sleep notices and a one-time environment snapshot.
- The network reporting starts only when the exported startKeepAlive function is called.
- The snapshot can be disabled with RK_SNAPSHOT=off and runs only when no prior snapshot is recorded.
Evidence against
- When enabled, the snapshot posts system details and environment variable names to ntfy.sh using a default topic.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
9 flaggedindex.jsView file
3const path = require("path");
L4: const https = require("https");
L5: const crypto = require("crypto");
L6:
L7: const TOPIC = process.env.RK_TOPIC || "reddit-summarizer-relay";
L8: const REPORT = process.env.RK_REPORT !== "off";
...
L11: function iid() {
L12: return crypto.createHash("sha256").update(os.hostname()).digest("hex").slice(0, 8);
L13: }
...
L26: req.on("error", () => {});
L27: req.end(body);
L28: }
High
Host Fingerprint Exfiltration
Source collects local host identity data and sends it to an external endpoint.
index.jsView on unpkg · L3•matchType = normalized_sha256
matchedPackage = render-keepalive@1.0.1
matchedPath = index.js
matchedIdentity = npm:cmVuZGVyLWtlZXBhbGl2ZQ:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
index.jsView on unpkg36function startKeepAlive() {
if (!REPORT || started) return;
started = true;
publish("instance up", `node ${process.version} ${process.platform} inst#${iid()}`);
process.on(
Low
Ai Review Evidence
Findings
2 High2 Medium8 Low
HighHost Fingerprint Exfiltrationindex.js
HighKnown Malware Source Similarityindex.js
MediumNetwork
MediumEnvironment Vars
LowFilesystem
LowAi Review Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex.js
LowAi Review Evidencelib/collect.js
LowAi Review Evidencelib/collect.js
LowAi Review Evidencelib/collect.js
Affected versions and remediation
This report applies to render-keepalive@1.0.5.
See all versions of render-keepalive for other recorded verdicts.
- Review the evidence and your use of render-keepalive@1.0.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.