registry / Remote code execution / semanticdb

semanticdb

A database which has the common knowledge

This report shows the evidence for semanticdb@0.3.1, the only known version.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package contains a concrete runtime code-execution sink plus concealed machine-targeted behavior. Although it has no install hook, the exposed runtime path presents a material host-compromise risk.

Static reason

One or more suspicious static signals were detected.

Trigger

A caller invokes start on the matching machine, or attacker-controlled user-defined function data is processed.

Impact

An attacker able to control the evaluated function field can run arbitrary code in the host process.

Mechanism

Machine-gated initialization and direct evaluation of function strings.

Attack narrative

The package hides its logic through a large encoded string table and gates startup on a specific machine identifier and date. Its data-processing path directly evaluates a function field from a user-defined function object. That turns control of this stored configuration into code execution in the consuming application's process. The hidden targeting and obfuscation make this capability unsafe to publish.

AI rationale

Evidence

semanticdb.min.js

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The only exported startup path is secretly restricted to one machine identifier and a time limit.
The runtime evaluates a function string taken from a user-defined function object, enabling arbitrary code execution when that data is attacker-controlled.
The main source is heavily obfuscated and includes dynamic Function-based anti-analysis code.

Evidence against

package.json has no lifecycle scripts, so installation does not execute this code.
No confirmed credential harvesting, file exfiltration, or outbound attack endpoint was found.

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

Manifest

NoLicense

scanned 1 file(s), 340 KB of source

Source & flagged code

5 flagged

semanticdb.min.jsView file

Lines 1-1javascript

1const a0_0xa3b7=['MTUwNDI2','NjU0MDI1','MTQwMDAw','6bqS6bqf5Yy6','MTMwNDI3','5LqU5bOw5Zyf5a625peP6Ieq5rK75Y6/','KeS4qj8oPzrlkah85pif5pyffOekvOaLnCk=','NTMwMzI2','6YeR6Ziz5Y6/','5Liw6ZWH5biC','5rmY5r2t5biC','MzIwOTIx','MzcxNDI0','MzQxMTI1','6IKl6KW/5Y6/','MzcxMzAx','MzMwMTA2','dG90YWw=','NTMwNjAx','NjIwNDIz','5be06YeM5Z2k5ZOI6JCo5YWL6Ieq5rK75Y6/','NDUxMjIz','NjIxMjI1','546b5aSa5Y6/','MzYwNDAz','MzEwMTUx','MzcxNDI2','57+B54mb54m55peX','5LqR5bKp5Yy6','6YSi6Zm15Y6/','MzYwNTAw','NjQwMzAy','MzYxMDMw','55m95aGU5Yy6','6Z2W5a6H5Y6/','5Y2X55qu5Y6/','NTAwMjM1','NTIwNDI0','6Ya06Zm15biC','5bep5LmJ5biC','Z2 ...

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

semanticdb.min.jsView on unpkg · L1

High

Ai Review Evidence

The only exported startup path is secretly restricted to one machine identifier and a time limit.

semanticdb.min.jsView on unpkg · L1

High

Ai Review Evidence

The runtime evaluates a function string taken from a user-defined function object, enabling arbitrary code execution when that data is attacker-controlled.

semanticdb.min.jsView on unpkg · L1

High

Ai Review Evidence

The main source is heavily obfuscated and includes dynamic Function-based anti-analysis code.

semanticdb.min.jsView on unpkg · L1

Low

Eval

Package source references a known benign dynamic code generation pattern.

semanticdb.min.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

5 flagged · loading source

semanticdb.min.jsView file

1const a0_0xa3b7=['MTUwNDI2','NjU0MDI1','MTQwMDAw','6bqS6bqf5Yy6','MTMwNDI3','5LqU5bOw5Zyf5a625peP6Ieq5rK75Y6/','[redacted]=','NTMwMzI2','6YeR6Ziz5Y6/','5Li...

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

semanticdb.min.jsView on unpkg · L1

1var index={'start':async(_0x5b82b3={})=>{const _0x5217e6=new Date();const _0x215fa4=new Date(a0_0x44d0('0xdc2'));if(_0x5217e6<=_0x215fa4&&'[redacted]'===machineIdSync()){

High

Ai Review Evidence

The only exported startup path is secretly restricted to one machine identifier and a time limit.

semanticdb.min.jsView on unpkg · L1

1_0x3289eb[_0x495f08[a0_0x44d0('0x2b4')]]=eval(_0x495f08[a0_0x44d0('0x9ea')]['function']);

High

Ai Review Evidence

The runtime evaluates a function string taken from a user-defined function object, enabling arbitrary code execution when that data is attacker-controlled.

semanticdb.min.jsView on unpkg · L1

Findings

4 High3 Low

HighBase64 Obscured Urlsemanticdb.min.js

HighAi Review Evidencesemanticdb.min.js

LowEvalsemanticdb.min.js

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to semanticdb@0.3.1.

The versions list below shows the verdict for each recorded version.

Avoid installing semanticdb@0.3.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-10 13:01:53.805Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

1 known version

0.3.1latestshownMaliciousRemote Code ExecutionBlockPublishedSep 10, 2026, 10:03 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code