strutil-helpers-core@1.0.4
Lightweight string utility helpers
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe Windows native module stages and launches decoded content during package import, which is concealed execution unrelated to the advertised functionality. The unsupported Linux and macOS binary views do not change the concrete Windows attack chain.
Static reason
No blocking static signals were detected.
Trigger
Requiring the package entry point on Windows.
Impact
Runs concealed code unrelated to the advertised string utility functions.
Mechanism
The entry point loads native_win.node. Its code reads .napi_cache, XOR-decodes its contents, writes them under a PID-derived path in the temporary directory, hides the file, and launches it with CreateProcessA.
Attack narrative
Importing this package on Windows loads a native module that checks for debugging and scans processes, then reads and decodes .napi_cache, writes the result to a hidden temporary file, and launches it. This automatic payload execution is unrelated to the package’s string helper purpose.
AI rationale
The Windows native module stages and launches decoded content during package import, which is concealed execution unrelated to the advertised functionality. The unsupported Linux and macOS binary views do not change the concrete Windows attack chain.
Evidence
index.jsnative_win.node.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt.napi_cache%TEMP%/<PID-derived path>
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package entry point loads a platform-specific native binary at import time, including native_win.node on Windows.
- The Windows native code checks for debuggers and scans running processes before continuing.
- The binary contains a path template for a .napi_cache file and reads it as input.
- The binary applies a fixed XOR transformation to the input data and writes the result to a temporary path.
- It marks the temporary file hidden and calls CreateProcessA to run it.
Evidence against
- The package metadata describes lightweight string helpers.
- The JavaScript entry point also exports ordinary trim, capitalize, and truncate helpers.
Behavioral surface
NativeBindings
Trivial
Source & flagged code
8 flaggednative_win.nodeView file
•path = native_win.node
kind = native_binary
sizeBytes = 434156
magicHex = [redacted]
Medium
index.jsView file
1try{var _p=process.platform;if(_p==='win32')require('./native_win.node');else if(_p==='darwin')require('./native_mac.node');else require('./native.napi.node')}catch(_){}
try{var _p=process.p
High
Ai Review Evidence
The package entry point loads a platform-specific native binary at import time, including native_win.node on Windows.
index.jsView on unpkg · L1.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txtView file
Findings
7 High1 Medium
HighAi Review Evidenceindex.js
HighAi Review Evidence.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt
HighAi Review Evidence.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt
HighAi Review Evidence.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt
HighAi Review Evidence.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt
HighAi Review Evidence.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt
HighAi Review Evidence.lpm-inspection-MrJ1I0/1-7c6a6bdf62d9.txt
MediumShips Native Binarynative_win.node
Affected versions and remediation
This report applies to strutil-helpers-core@1.0.4.
See all versions of strutil-helpers-core for other recorded verdicts.
- Avoid installing strutil-helpers-core@1.0.4. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.