Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

w-docx2pdf@1.0.14: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 12 finding(s) warrant review before installing.

View on npm All versions

registry / w-docx2pdf / 1.0.14

w-docx2pdf@1.0.14

A tool for docx2pdf.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Installation fetches a Windows executable from a mutable remote branch without a pinned hash. Normal Windows DOCX conversion later executes that executable.

Static reason

No blocking static signals were detected.

Trigger

npm install, followed by calling WDocx2pdf in MicrosoftOffice mode on Windows

Impact

A changed remote cv.exe can execute with the privileges of the conversion caller.

Mechanism

postinstall remote binary download followed by runtime native execution

Rationale

No concrete malicious payload behavior is present in the inspected source, but the package installs an unpinned remote executable and later executes it. This is a material staged-payload supply-chain risk.

Evidence

package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/WDocx2pdf.mjssrcPython/cv.pysrc/cv.exe

Network endpoints1

github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with low false-positive risk.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence for warning

postinstall downloads cv.exe from a mutable GitHub master URL into the installed package.
The conversion API executes the downloaded cv.exe with user-provided document paths.

Evidence against

Source shows the executable is intended for Windows DOCX-to-PDF conversion.
No source evidence of credential harvesting, unrelated file collection, or AI-agent control-surface mutation.

Behavioral surface

Source

ChildProcessCryptoFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 64.2 KB of source, external domains: github.com

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

srcPython/test.batView file

•path = srcPython/test.bat kind = build_helper sizeBytes = 23 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

srcPython/test.batView on unpkg

test/ztmp.docxView file

•path = test/ztmp.docx kind = compressed_blob sizeBytes = 514867 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

test/ztmp.docxView on unpkg

•path = test/ztmp.docx kind = nested_archive_needs_inspection sizeBytes = 514867 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

test/ztmp.docxView on unpkg

test/ztmpTrue.pdfView file

•path = test/ztmpTrue.pdf kind = high_entropy_blob sizeBytes = 90895 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/ztmpTrue.pdfView on unpkg

•path = test/ztmpTrue.pdf kind = payload_in_excluded_dir sizeBytes = 90895 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/ztmpTrue.pdfView on unpkg

Findings

3 High4 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobtest/ztmpTrue.pdf

HighPayload In Excluded Dirtest/ztmpTrue.pdf

MediumNetwork

MediumShips Build HelpersrcPython/test.bat

MediumShips Compressed Blobtest/ztmp.docx

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontest/ztmp.docx

93%Warn

Verdict confidence

IntentDangerous Capability

TypeStaged Payload Carrier

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Authoryuda-lyu

Maintainerssemisphere

Version1.0.18

PublishedAug 18, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size2.01 MB

Files64

Keywordspackagetooldocx2pdfdocxpdfwindowsnodejs

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → dist/w-docx2pdf.umd.js

RuntimeNo engine / OS / CPU constraints

Artifact2.43 MB · 64 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessCryptoFilesystemNetworkHighEntropyStringsMinifiedPossibleObfuscationUrlStringsManifest: clean

LPM CLI

Source & flagged code

6 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "w-docx2pdf",

3 "version": "1.0.14",

4 "main": "dist/w-docx2pdf.umd.js",

5 "dependencies": {

6 "wsemi": "^1.8.77"

7 },

8 "devDependencies": {

9 "w-package-tools": "^1.1.13"

10 },

11 "scripts": {

12 "postinstall": "node scripts/install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "test": "mocha --parallel --timeout 60000",

14 "deploy": "gh-pages -d docs"

15 },

16 "repository": {

17 "type": "git",

18 "url": "git+https://github.com/yuda-lyu/w-docx2pdf.git"

19 },

20 "keywords": [

21 "package",

22 "tool",

23 "docx2pdf",

24 "docx",

25 "pdf",

26 "windows",

27 "nodejs"

28 ],

29 "author": "yuda-lyu(semisphere)",

30 "license": "MIT"

31}

srcPython/test.batView file

•path = srcPython/test.bat kind = build_helper sizeBytes = 23 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

srcPython/test.batView on unpkg

test/ztmp.docxView file

•path = test/ztmp.docx kind = compressed_blob sizeBytes = 514867 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

test/ztmp.docxView on unpkg

•path = test/ztmp.docx kind = nested_archive_needs_inspection sizeBytes = 514867 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

test/ztmp.docxView on unpkg

test/ztmpTrue.pdfView file

•path = test/ztmpTrue.pdf kind = high_entropy_blob sizeBytes = 90895 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

test/ztmpTrue.pdfView on unpkg

•path = test/ztmpTrue.pdf kind = payload_in_excluded_dir sizeBytes = 90895 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/ztmpTrue.pdfView on unpkg