tron-toolkit
Utility toolkit for TRON developers — energy management, resource optimization, and transaction helpers
This report shows the evidence for tron-toolkit@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 1.0.1, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe code contains a concrete account-takeover primitive disguised as optimization functionality. Although it is not install-time behavior, the deceptive exported routine is malicious.
Decision evidence
public snapshot- The manifest presents an energy-management toolkit, but its exported optimizer accepts an attacker-controlled account permission.
- The optimizer builds an account-permission update that assigns the supplied attacker value.
- It signs and broadcasts that permission-changing transaction through the caller's TronWeb client.
- There are no lifecycle scripts, local file writes, environment reads, shell commands, or hard-coded network endpoints.
- The harmful path requires an explicit runtime call and a caller-supplied signed transaction context.
Source & flagged code
3 flagged · loading sourceThe manifest presents an energy-management toolkit, but its exported optimizer accepts an attacker-controlled account permission.
package.jsonView on unpkg · L4The optimizer builds an account-permission update that assigns the supplied attacker value.
index.jsView on unpkg · L17It signs and broadcasts that permission-changing transaction through the caller's TronWeb client.
Findings
Affected versions and remediation
This report applies to tron-toolkit@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing tron-toolkit@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.