w-docx2pdf@1.0.17
A tool for docx2pdf.
AI Security Review
scanned 15d ago · by lpm-firewall-aiThe source shows a package-aligned conversion workflow, but it also fetches an executable during postinstall and runs it during conversion; the binary’s behavior could not be inspected through the source reader. This supports a warning for unresolved executable risk, not a finding of malicious intent.
Static reason
No blocking static signals were detected.
Trigger
Package installation triggers the download; a caller invoking Microsoft Office conversion on Windows triggers execution.
Impact
This introduces a remotely fetched executable into the installed package and runs it during requested conversion, creating unresolved executable supply-chain risk.
Mechanism
The installer writes cv.exe under the package source directory, and the converter passes it DOCX and PDF paths through its process helper.
AI rationale
The source shows a package-aligned conversion workflow, but it also fetches an executable during postinstall and runs it during conversion; the binary’s behavior could not be inspected through the source reader. This supports a warning for unresolved executable risk, not a finding of malicious intent.
Evidence
package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/WDocx2pdf.mjsdist/w-docx2pdf.umd.jssrc/cv.exe
Network endpoints1
github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that downloads a Windows executable from a GitHub URL into the package source directory.
- The converter selects that executable and runs it on Windows when Microsoft Office mode is used.
Evidence against
- The executable supports the package’s stated DOCX-to-PDF purpose and runs only when conversion is invoked on Windows.
- The installer limits the download to installations where the package path includes node_modules.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrcPython/test.batView file
•path = srcPython/test.bat
kind = build_helper
sizeBytes = 23
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
srcPython/test.batView on unpkgtest/ztmp.docxView file
•path = test/ztmp.docx
kind = compressed_blob
sizeBytes = 514867
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/ztmpTrue.pdf
HighPayload In Excluded Dirtest/ztmpTrue.pdf
HighSemantic Analysis Limiteddist/w-docx2pdf.umd.js#virtual:normalized:round1
MediumNetwork
MediumShips Build HelpersrcPython/test.bat
MediumShips Compressed Blobtest/ztmp.docx
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiontest/ztmp.docx
Affected versions and remediation
This report applies to w-docx2pdf@1.0.17.
See all versions of w-docx2pdf for other recorded verdicts.
- Review the evidence and your use of w-docx2pdf@1.0.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.