registry / Remote code execution / w-docx2pdf

w-docx2pdf

A tool for docx2pdf.

This report shows the evidence for w-docx2pdf@1.0.22. 2 of 17 known versions are blocked or flagged. The newest version, 1.0.29, is allowed. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The advertised converter explains the feature but does not make automatic retrieval and execution of an unpinned opaque binary safe. This is concrete remote payload execution through an install and runtime supply-chain path.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

npm installation triggers postinstall; calling the MicrosoftOffice conversion mode triggers execution.

Impact

A later change to the remote executable can run arbitrary code on Windows systems that install or use the package.

Mechanism

Automatic remote binary download followed by native process execution.

Attack narrative

The package runs postinstall, which downloads cv.exe from an unpinned GitHub master branch into its source directory. If that file is missing, runtime code downloads it again. The normal MicrosoftOffice conversion path then launches the downloaded executable. Because the executable is not shipped or integrity-pinned in this package, the remote branch controls code executed on Windows consumer machines.

AI rationale

Evidence

package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/autoDownloadFiles.mjssrc/WDocx2pdf.mjssrc/cv.exe

Network endpoints1

github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

The postinstall hook automatically runs an installer.
The installer downloads an executable from an unpinned GitHub master branch into the package.
Runtime fallback downloads the executable again if it is absent.
The package executes the downloaded executable with document paths.

Evidence against

The included Python source implements DOCX-to-PDF conversion.
The executable path is used only on Windows and is tied to the advertised conversion feature.
No source evidence shows credential harvesting, broad project mutation, or unrelated exfiltration.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 69.2 KB of source, external domains: github.com

Source & flagged code

8 flagged

package.jsonView file

Lines 1-31json

2 "name": "w-docx2pdf",

3 "version": "1.0.22",

4 "main": "dist/w-docx2pdf.umd.js",

5 "dependencies": {

6 "wsemi": "^1.8.92"

7 },

8 "devDependencies": {

9 "w-package-tools": "^1.1.16"

10 },

11 "scripts": {

12 "postinstall": "node scripts/install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "test": "mocha --parallel \"test/*.test.mjs\" --timeout 180000",

14 "deploy": "gh-pages -d docs"

15 },

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/yuda-lyu/w-docx2pdf.git"

19 },

20 "keywords": [

21 "package",

22 "tool",

23 "docx2pdf",

24 "docx",

25 "pdf",

26 "windows",

27 "nodejs"

28 ],

29 "author": "yuda-lyu(semisphere)",

30 "license": "MIT"

31}

srcPython/test.batView file

•path = srcPython/test.bat kind = build_helper sizeBytes = 23 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

srcPython/test.batView on unpkg

test/ztmp.docxView file

•path = test/ztmp.docx kind = compressed_blob sizeBytes = 514867 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

test/ztmp.docxView on unpkg

•path = test/ztmp.docx kind = nested_archive_needs_inspection sizeBytes = 514867 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

test/ztmp.docxView on unpkg

test/ztmpTrue.pdfView file

•path = test/ztmpTrue.pdf kind = high_entropy_blob sizeBytes = 90895 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/ztmpTrue.pdfView on unpkg

•path = test/ztmpTrue.pdf kind = payload_in_excluded_dir sizeBytes = 90895 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/ztmpTrue.pdfView on unpkg

dist/w-docx2pdf.umd.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/w-docx2pdf.umd.js#virtual:normalized:round1View on unpkg

dist/w-docx2pdf.umd.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = w-docx2pdf@1.0.20 matchedIdentity = npm:dy1kb2N4MnBkZg:1.0.20 similarity = 0.941 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/w-docx2pdf.umd.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

srcPython/test.batView file

•path = srcPython/test.bat kind = build_helper sizeBytes = 23 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

srcPython/test.batView on unpkg

test/ztmp.docxView file

•path = test/ztmp.docx kind = compressed_blob sizeBytes = 514867 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

Findings

5 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobtest/ztmpTrue.pdf

HighPayload In Excluded Dirtest/ztmpTrue.pdf

HighSemantic Analysis Limiteddist/w-docx2pdf.umd.js#virtual:normalized:round1

HighPrevious Version Dangerous Deltadist/w-docx2pdf.umd.js

MediumNetwork

MediumShips Build HelpersrcPython/test.bat

MediumShips Compressed Blobtest/ztmp.docx

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontest/ztmp.docx

Affected versions and remediation

This report applies to w-docx2pdf@1.0.22.

The versions list below shows the verdict for each recorded version.

Avoid installing w-docx2pdf@1.0.22. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-14 00:00:21.687Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

17 known versions

1.0.29latestManual Review—AllowUnder ReviewOct 19, 2026, 5:08 PM 1.0.28SuspiciousStaged Payload CarrierWarnPublishedOct 11, 2026, 5:12 AM 1.0.27SuspiciousStaged Payload CarrierWarnPublishedOct 10, 2026, 2:06 PM 1.0.26Manual Review—AllowUnder ReviewOct 2, 2026, 7:27 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Related packages

Other remote code execution packages

Source & flagged code