AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for block
- index.js is deliberately obfuscated and includes anti-analysis code.
- provider() imports node:child_process and spawns a platform shell.
- Shell stdout/stderr is POSTed to the caller-supplied server URL.
- provider() polls that server for commands and writes them to shell stdin.
- Recurring requests send host CPU, RAM, and platform data.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The network base URL is supplied explicitly to provider(), not hard-coded.
- README.md shows provider() as an explicit user invocation.
Behavioral surface
SourceNo risky source behavior triggered.
Supply chainHighEntropyStringsMinifiedObfuscatedTrivial
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 112 KB of source