tdem-electron-sdk@0.4.2
tdem sdk for electron applications
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has a real data-exfiltration surface for filesystem metadata after explicit SDK initialization, but the source does not establish malicious installation behavior or covert payload execution. Warn so consumers can assess telemetry consent and collector configuration.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A consumer initializes the Electron main or renderer SDK with telemetry enabled.
Impact
Filesystem paths, operation types, timing, and related telemetry may leave the application.
Mechanism
Filesystem-operation instrumentation and outbound telemetry reporting.
AI rationale
The package has a real data-exfiltration surface for filesystem metadata after explicit SDK initialization, but the source does not establish malicious installation behavior or covert payload execution. Warn so consumers can assess telemetry consent and collector configuration.
Evidence
lib/tdemelectron-main.mjslib/tdemelectron-main.cjslib/tdemelectron-renderer.mjs
Network endpoints1
dem.rumt-zh.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The main bundle defines a default telemetry collector and uses Electron networking to send requests.
- The main bundle records filesystem operation metadata, including file paths.
- The renderer bundle records filesystem operation metadata, including file paths.
Evidence against
- package.json has no preinstall, install, postinstall, or other automatic lifecycle hook.
- The observed behavior is activated by the Electron SDK initialization path, not package installation or import alone.
- Source inspection found no command execution, credential harvesting, or destructive action.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
6 flaggedlib/tdemelectron-renderer.mjsView file
1var ft=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar...
L2: Error.stack: ${r.stack}`;if(typeof r=="object"&&r!==null){if(e.has(r))return`[Circular ${t||"root"}]`;e.add(r)}return r}},Fr=function(e){if(typeof e=="string")return e;try{return e...
...
L5: ${t.message}
L6: ${t.stack}`}},Do=function(e,t=3){let r="";if(Array.isArray(e)){r+="[";let n=e.length;e.forEach((i,o)=>{typeof i=="object"&&t>1?r+=Do(i,t-1):r+=eg(i),r+=`${o===n-1?"":","}`}),r+="]"...
L7: `),n=0;for(let i of r){let o=i.match(/at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)/);if(o){let[,s,l,c,u]=o,a=l.split("/").pop()||l;t.push({abs_path:l,colno:parseInt(u,10),filename:a,function...
L8: `).reduce((r,n)=>{let i
High
Browser Session Account Hijack
Browser source reuses an authenticated session to collect identity data and mutate account settings while reporting externally.
lib/tdemelectron-renderer.mjsView on unpkg · L1lib/tdemelectron-main.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = tdem-electron-sdk@0.4.1
matchedIdentity = npm:dGRlbS1lbGVjdHJvbi1zZGs:0.4.1
similarity = 0.647
summary = stored previous version shares package body but lacks this dangerous source file
Findings
1 Critical4 High3 Medium4 Low
CriticalPrevious Version Dangerous Deltalib/tdemelectron-main.cjs
HighBrowser Session Account Hijacklib/tdemelectron-renderer.mjs
HighCommand Output Exfiltrationlib/tdemelectron-main.cjs
HighTrigger Reachable Command Output Exfiltrationlib/tdemelectron-main.mjs
HighSemantic Analysis Limitedpackage.json
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencelib/tdemelectron-main.mjs
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to tdem-electron-sdk@0.4.2.
See all versions of tdem-electron-sdk for other recorded verdicts.
- Review the evidence and your use of tdem-electron-sdk@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.