strutil-helpers-core@1.0.3
Lightweight string utility helpers
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe package automatically executes a concealed bundled JavaScript payload during import on Windows. This behavior is unrelated to its stated string-helper purpose and supports blocking the release.
Static reason
No blocking static signals were detected.
Trigger
Requiring the package loads the Windows native addon, whose registration routine runs automatically.
Impact
The concealed payload can execute arbitrary code with the importing process’s privileges; its contents could not be established from the available binary view.
Mechanism
The addon reads .napi_cache, XOR-transforms its bytes, writes a temporary .js file and launches it with Node.
Attack narrative
On Windows, importing this string-helper package loads a native addon that automatically reads and transforms the bundled .napi_cache payload, writes it as a temporary JavaScript file, and launches Node to execute it. The payload’s purpose is unrelated to the package’s stated utility purpose and could not be established from the available binary view.
AI rationale
The package automatically executes a concealed bundled JavaScript payload during import on Windows. This behavior is unrelated to its stated string-helper purpose and supports blocking the release.
Evidence
index.js.napi_cachenative_win.node.lpm-inspection-5T3vOu/1-cce90a62da92.txt%TEMP%\<temp-path>.nc%lu.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- Importing index.js automatically requires a platform-specific native addon.
- The Windows addon’s module registration calls a routine that runs during import.
- The native routine opens a .napi_cache file beside the addon and XOR-transforms its contents.
- The routine writes the transformed bytes to a temporary JavaScript file and starts Node to run it.
Evidence against
- package.json declares no lifecycle scripts or runtime dependencies.
- The JavaScript entry point also exports ordinary trim, capitalize and truncate helpers.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
9 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434161
magicHex = [redacted]
Medium
index.jsView file
1try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='darwin')require('./native_mac.node');else require('./native.napi.node')}catch(_){}
try{if(process.platform==='win
High
Ai Review Evidence
Importing index.js automatically requires a platform-specific native addon.
index.jsView on unpkg · L1.lpm-inspection-5T3vOu/1-cce90a62da92.txtView file
572
Findings
8 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
HighAi Review Evidence.lpm-inspection-5T3vOu/1-cce90a62da92.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to strutil-helpers-core@1.0.3.
See all versions of strutil-helpers-core for other recorded verdicts.
- Avoid installing strutil-helpers-core@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.