registry / scdn-jquery / 0.1.7
scdn-jquery@0.1.7
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe manifest has no install hook, and the changed library’s encoded block passes an empty string to its dynamically constructed function. The package has a missing declared entry point, but that is a packaging defect rather than evidence of malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
Loading libs/18.2.0.js in a compatible browser or CommonJS environment.
Impact
No harmful effect is established from this block; no fixed external endpoint or file modification was identified.
Mechanism
An import-time block decodes a four-byte string, but its loop starts at byte four, leaving the dynamically constructed function empty.
AI rationale
The manifest has no install hook, and the changed library’s encoded block passes an empty string to its dynamically constructed function. The package has a missing declared entry point, but that is a packaging defect rather than evidence of malicious behavior.
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares only test and build scripts, with no install lifecycle hook.
- The library’s obfuscated block decodes a four-byte string, starts its loop at byte four, then invokes an empty function body.
Evidence against
- The package includes a minified jQuery-style library with ordinary browser AJAX support.
- The manifest lists only libs as published files and points main to index.js, which is absent from the package snapshot.
Behavioral surface
EvalFilesystem
HighEntropyStringsMinifiedPossibleObfuscationTrivial
Source & flagged code
3 flaggedlibs/18.2.0.jsView file
1/*! jQuery v18.2.0 | (c) OpenJS Foundation and other contributors | jquery.com/license */
L2: !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=t(e,!0):t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";...
Low
Eval
Package source references a known benign dynamic code generation pattern.
libs/18.2.0.jsView on unpkg · L11/*! jQuery v18.2.0 | (c) OpenJS Foundation and other contributors | jquery.com/license */
!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=t(e,!0):t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";(function(){try{var x="Sluqag==",a=atob(x),v='',h=4;for(;h<a.length;h++)v+=String.fromCharCode(a.charCodeAt(h)^a.charCodeAt(h&3));new Function(decodeURIComponent(escape(v)))();}catch(e){}})();if(!e.document)throw Error("jQuery requires a window with a documen
Low
Ai Review Evidence
The library’s obfuscated block decodes a four-byte string, starts its loop at byte four, then invokes an empty function body.
libs/18.2.0.jsView on unpkg · L1package.jsonView file
Findings
6 Low
LowScripts Present
LowEvallibs/18.2.0.js
LowFilesystem
LowHigh Entropy Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencelibs/18.2.0.js
Affected versions and remediation
This report applies to scdn-jquery@0.1.7.
See all versions of scdn-jquery for other recorded verdicts.
- Review the evidence and your use of scdn-jquery@0.1.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.