registry / w-docx2pdf / 1.0.18

w-docx2pdf@1.0.18

A tool for docx2pdf.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Installing the package downloads an unpinned remote executable into the consumer project's src/cv.exe. Calling the converter later executes that downloaded binary.

Static reason

No blocking static signals were detected.

Trigger

npm installation, followed by use of the Microsoft Office conversion mode

Impact

A mutable remote executable can be placed in and later run from the consumer project.

Mechanism

postinstall remote executable drop followed by runtime execution

Attack narrative

The postinstall hook invokes code that uses the install working directory, rather than the package directory, to form a consumer-project src path. It downloads cv.exe from a mutable GitHub master URL without a version pin or hash. The package's conversion function then searches that project path and executes cv.exe. This creates an automatic remote binary delivery path outside the package boundary.

Rationale

The automatic unpinned executable download into the consumer project and its later execution form a concrete install-hook supply-chain attack surface. The visible converter source does not mitigate the opaque remote binary.

Evidence

package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/WDocx2pdf.mjssrc/cv.exe

Network endpoints1

github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe

w-docx2pdf@1.0.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code