strutil-helpers-core@1.0.2
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe Windows addon performs hidden, automatic payload staging and execution during import, which is unrelated to the package’s stated string helper purpose. Because the payload itself is unreadable and its behavior cannot be established, this is suspicious rather than a confirmed malicious attack.
Static reason
No blocking static signals were detected.
Trigger
Importing index.js on Windows loads native_win.node automatically.
Impact
Unknown code runs automatically during import; its effects cannot be determined from the readable package source.
Mechanism
The native addon reads .napi_cache, transforms its bytes, writes a temporary .js file, marks it hidden, and launches a process to run it. The payload contents were unreadable, so its behavior could not be established.
AI rationale
The Windows addon performs hidden, automatic payload staging and execution during import, which is unrelated to the package’s stated string helper purpose. Because the payload itself is unreadable and its behavior cannot be established, this is suspicious rather than a confirmed malicious attack.
Evidence
index.jsnative_win.node.napi_cache.lpm-inspection-hUS6Mu/1-1feab0526276.txt%TEMP%/<pid>.nc<pid>.js
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest describes lightweight string helpers and has no lifecycle scripts.
- Importing index.js loads a platform-specific native addon at top level; the Windows load is duplicated.
- The Windows addon reads a colocated .napi_cache, transforms its contents, writes a temporary JavaScript file, marks it hidden, and starts a process.
- The native analysis shows a CreateProcessA call during addon initialization, while the package source does not explain this behavior.
Evidence against
- The JavaScript exports only trim, capitalize, and truncate helpers.
- No network endpoint or network API was identified in the inspected Windows addon analysis.
- The .napi_cache payload could not be read as UTF-8, so its behavior and purpose remain unknown.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
7 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434139
magicHex = [redacted]
Medium
package.jsonView file
1{
"name": "strutil-helpers-core",
"version": "1.0.2",
"description": "Lightweight string utility helpers",
"main": "index.js",
"keywords": [
Medium
Suspicious Lifecycle Evidence
The manifest describes lightweight string helpers and has no lifecycle scripts.
package.jsonView on unpkg · L1index.jsView file
1try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win32')require('./native_win.node');else require('./native.napi.
Findings
7 Medium
MediumShips Native Binarynative_win.node
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidenceindex.js
MediumAi Review Evidence.lpm-inspection-hUS6Mu/1-1feab0526276.txt
MediumAi Review Evidence.lpm-inspection-hUS6Mu/1-1feab0526276.txt
MediumAi Review Evidence.lpm-inspection-hUS6Mu/1-1feab0526276.txt
MediumAi Review Evidence.lpm-inspection-hUS6Mu/1-1feab0526276.txt
Affected versions and remediation
This report applies to strutil-helpers-core@1.0.2.
See all versions of strutil-helpers-core for other recorded verdicts.
- Review the evidence and your use of strutil-helpers-core@1.0.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.