Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

w-docx2pdf@1.0.10: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / w-docx2pdf / 1.0.10

w-docx2pdf@1.0.10

A tool for docx2pdf.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Installation downloads an executable from a mutable GitHub branch into the consuming project's src directory. A later document-conversion call executes that downloaded binary.

Static reason

No blocking static signals were detected.

Trigger

npm postinstall, followed by WDocx2pdf MicrosoftOffice conversion

Impact

A changed remote binary can execute with the user's privileges when conversion is invoked.

Mechanism

unpinned remote executable staging and runtime execution

Rationale

This is not proven intentional malware, but it stages an unverified remote executable during installation outside its package directory and later runs it. Warn until the executable is packaged and integrity-pinned.

Evidence

package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/WDocx2pdf.mjssrcPython/cv.pysrc/cv.exe

Network endpoints1

github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence for warning

package.json runs postinstall
scripts/install.mjs invokes download on npm install
src/downloadFiles.mjs fetches unpinned master cv.exe
download target resolves to project src/cv.exe
src/WDocx2pdf.mjs executes cv.exe at runtime

Evidence against

srcPython/cv.py is a docx2pdf conversion wrapper
No credential harvesting or exfiltration found
No AI-agent/configuration manipulation found

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 64.2 KB of source, external domains: github.com

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

srcPython/test.batView file

•path = srcPython/test.bat kind = build_helper sizeBytes = 23 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

srcPython/test.batView on unpkg

test/ztmp.docxView file

•path = test/ztmp.docx kind = compressed_blob sizeBytes = 514867 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

test/ztmp.docxView on unpkg

•path = test/ztmp.docx kind = nested_archive_needs_inspection sizeBytes = 514867 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

test/ztmp.docxView on unpkg

test/ztmpTrue.pdfView file

•path = test/ztmpTrue.pdf kind = high_entropy_blob sizeBytes = 90895 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/ztmpTrue.pdfView on unpkg

•path = test/ztmpTrue.pdf kind = payload_in_excluded_dir sizeBytes = 90895 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/ztmpTrue.pdfView on unpkg

Findings

3 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobtest/ztmpTrue.pdf

HighPayload In Excluded Dirtest/ztmpTrue.pdf

MediumNetwork

MediumShips Build HelpersrcPython/test.bat

MediumShips Compressed Blobtest/ztmp.docx

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontest/ztmp.docx

93%Warn

Verdict confidence

IntentDangerous Capability

TypeStaged Payload Carrier

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Authoryuda-lyu

Maintainerssemisphere

Version1.0.18

PublishedAug 8, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size2.01 MB

Files64

Keywordspackagetooldocx2pdfdocxpdfwindowsnodejs

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/w-docx2pdf.umd.js

RuntimeNo engine / OS / CPU constraints

Artifact2.43 MB · 64 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoFilesystemNetworkHighEntropyStringsMinifiedObfuscatedUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "w-docx2pdf",

3 "version": "1.0.10",

4 "main": "dist/w-docx2pdf.umd.js",

5 "dependencies": {

6 "wsemi": "^1.8.70"

7 },

8 "devDependencies": {

9 "w-package-tools": "^1.1.12"

10 },

11 "scripts": {

12 "postinstall": "node scripts/install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "test": "mocha --parallel --timeout 60000",

14 "deploy": "gh-pages -d docs"

15 },

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/yuda-lyu/w-docx2pdf.git"

19 },

20 "keywords": [

21 "package",

22 "tool",

23 "docx2pdf",

24 "docx",

25 "pdf",

26 "windows",

27 "nodejs"

28 ],

29 "author": "yuda-lyu(semisphere)",

30 "license": "MIT"

31}

srcPython/test.batView file

•path = srcPython/test.bat kind = build_helper sizeBytes = 23 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

srcPython/test.batView on unpkg

test/ztmp.docxView file

•path = test/ztmp.docx kind = compressed_blob sizeBytes = 514867 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

test/ztmp.docxView on unpkg

•path = test/ztmp.docx kind = nested_archive_needs_inspection sizeBytes = 514867 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

test/ztmp.docxView on unpkg

test/ztmpTrue.pdfView file

•path = test/ztmpTrue.pdf kind = high_entropy_blob sizeBytes = 90895 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/ztmpTrue.pdfView on unpkg

•path = test/ztmpTrue.pdf kind = payload_in_excluded_dir sizeBytes = 90895 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/ztmpTrue.pdfView on unpkg