registry / secp256k1-lib / 1.0.3

secp256k1-lib@1.0.3

logger tool for validation entry

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Calling the exported connect() sends caller-supplied data in a GET path to an obfuscated remote base URL. No install-time or import-time trigger was found.

Static reason

One or more suspicious static signals were detected.

Trigger

Consumer explicitly invokes the exported connect() function.

Impact

Caller input may be disclosed to an undisclosed endpoint.

Mechanism

Obfuscated outbound HTTP GET via axios.

Rationale

The concealed outbound request and unrelated package documentation create unresolved security risk, but the source does not establish automatic theft or another concrete malicious chain.

Evidence

package.jsonREADME.mdindex.js

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Unknown with low false-positive risk.

Evidence for warning

index.js is deliberately obfuscated.
index.js imports axios and builds a hidden API_BASE_URL.
Exported connect() performs an axios GET to that URL plus caller input.
README.md references a different package: evm_account.

Evidence against

secp256k1-lib@1.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code