registry / tdem-electron-sdk / 0.4.3
tdem-electron-sdk@0.4.3
tdem sdk for electron applications
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source supports a telemetry SDK with explicit runtime activation rather than an install-time malware chain. Its preload mutation and configurable HTTP/body collection are broad enough to warrant a warning while no concrete malicious payload or account hijack was verified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
An Electron application explicitly calls the package's main or renderer init function.
Impact
Sensitive HTTP data could be reported if the host enables detailed request collection or selects sensitive headers.
Mechanism
Electron preload injection and HTTP telemetry instrumentation
AI rationale
The source supports a telemetry SDK with explicit runtime activation rather than an install-time malware chain. Its preload mutation and configurable HTTP/body collection are broad enough to warrant a warning while no concrete malicious payload or account hijack was verified.
Evidence
lib/tdemelectron-main.mjslib/tdemelectron-renderer.mjslib/preload.cjs
Network endpoints1
dem.rumt-zh.com
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- Runtime initialization can add the package preload to an Electron session's existing preload list.
- The renderer HTTP monitor can collect configured request headers, response headers, and request or response bodies for telemetry.
- Optional nodeInjection enables a child-process injection integration.
Evidence against
- package.json has no npm install lifecycle hook; its only lifecycle script is prepublishOnly.
- The main initializer requires a non-empty project ID and an explicit HTTP(S) collector URL.
- No source evidence showed credential theft, account-setting changes, remote code loading, or automatic execution on install.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flaggedscripts/assert-node-sdk-published.jsView file
5const path = require('path');
L6: const { execFileSync } = require('child_process');
L7:
High
Child Process
Package source references child process execution.
scripts/assert-node-sdk-published.jsView on unpkg · L53L4: const fs = require('fs');
L5: const path = require('path');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
scripts/assert-node-sdk-published.jsView on unpkg · L3lib/tdemelectron-renderer.mjsView file
1var pt=(e=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(e,{get:(t,r)=>(typeof require<"u"?require:t)[r]}):e)(function(e){if(typeof require<"u")return require.apply(this,ar...
L2: Error.stack: ${r.stack}`;if(typeof r=="object"&&r!==null){if(e.has(r))return`[Circular ${t||"root"}]`;e.add(r)}return r}},Ur=function(e){if(typeof e=="string")return e;try{return e...
...
L5: ${t.message}
L6: ${t.stack}`}},Wo=function(e,t=3){let r="";if(Array.isArray(e)){r+="[";let n=e.length;e.forEach((i,o)=>{typeof i=="object"&&t>1?r+=Wo(i,t-1):r+=mg(i),r+=`${o===n-1?"":","}`}),r+="]"...
L7: `),n=0;for(let i of r){let o=i.match(/at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)/);if(o){let[,s,l,c,u]=o,a=l.split("/").pop()||l;t.push({abs_path:l,colno:parseInt(u,10),filename:a,function...
L8: `).reduce((r,n)=>{let i
Findings
1 Critical5 High4 Medium5 Low
CriticalPrevious Version Dangerous Deltalib/tdemelectron-main.cjs
HighChild Processscripts/assert-node-sdk-published.js
HighBrowser Session Account Hijacklib/tdemelectron-renderer.mjs
HighCommand Output Exfiltrationlib/tdemelectron-main.cjs
HighTrigger Reachable Command Output Exfiltrationlib/tdemelectron-main.mjs
HighSemantic Analysis Limitedpackage.json
MediumDynamic Requirescripts/assert-node-sdk-published.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to tdem-electron-sdk@0.4.3.
See all versions of tdem-electron-sdk for other recorded verdicts.
- Review the evidence and your use of tdem-electron-sdk@0.4.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.