registry / secp256k1-lib / 1.0.2

secp256k1-lib@1.0.2

logger tool for validation entry

AI Security Review

scanned 16d ago · by lpm-firewall-ai

The exported connect function forwards its argument to a third-party relay URL. No automatic install- or import-time behavior is present.

Static reason

No blocking static signals were detected.

Trigger

Consumer calls connect(data).

Impact

Potential disclosure of data supplied to the function to the relay operator.

Mechanism

Axios GET request with caller-controlled path data.

Rationale

Source inspection found an explicit, user-invoked remote forwarding function and no lifecycle or local compromise behavior. The unexplained third-party relay makes the package unsuitable to mark clean.

Evidence

package.jsonindex.jsREADME.md

Network endpoints1

api-relay-server-eexysjiyg-hdniis-projects.vercel.app/api/

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

index.js exports connect(data), which sends caller data by GET to an unrelated Vercel relay.
The package name implies cryptography, but its only implementation is remote data forwarding.

secp256k1-lib@1.0.2

AI Security Review

Decision evidence

Source & flagged code

Findings