w-docx2pdf@1.0.27
A tool for docx2pdf.
AI Security Review
scanned 13d ago · by lpm-firewall-aiSource confirms an install-time download and later execution of a remote Windows binary, but the inspected code connects both to DOCX-to-PDF conversion and shows no separate attack behavior. The binary artifact could not be verified, so this unresolved executable behavior warrants a warning rather than a clean verdict or a claim of malware.
Static reason
No blocking static signals were detected.
Trigger
Package installation downloads the executable; calling the conversion function in Microsoft Office mode runs it.
Impact
The executable runs with the caller's privileges; its effects are unknown because the required binary artifact was not inspectable as source.
Mechanism
The hook fetches cv.exe from a GitHub repository into a source directory, and the conversion path invokes that executable with conversion input.
AI rationale
Source confirms an install-time download and later execution of a remote Windows binary, but the inspected code connects both to DOCX-to-PDF conversion and shows no separate attack behavior. The binary artifact could not be verified, so this unresolved executable behavior warrants a warning rather than a clean verdict or a claim of malware.
Evidence
package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/WDocx2pdf.mjssrc/cv.exe
Network endpoints1
github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe
Decision evidence
public snapshotAI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The postinstall hook downloads a Windows executable from the package's GitHub repository into a source directory.
- The executable is invoked when the conversion function runs in Microsoft Office mode.
- The executable's contents could not be verified from the required binary artifact, so its behavior remains unresolved.
Evidence against
- The postinstall script returns when the package is not installed under node_modules, limiting its install-time action.
- The download and execution are connected to the package's documented DOCX-to-PDF conversion path.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrcPython/test.batView file
•path = srcPython/test.bat
kind = build_helper
sizeBytes = 23
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
srcPython/test.batView on unpkgtest/ztmp.docxView file
•path = test/ztmp.docx
kind = compressed_blob
sizeBytes = 514867
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/ztmpTrue.pdf
HighPayload In Excluded Dirtest/ztmpTrue.pdf
HighSemantic Analysis Limiteddist/w-docx2pdf.umd.js#virtual:normalized:round1
MediumNetwork
MediumShips Build HelpersrcPython/test.bat
MediumShips Compressed Blobtest/ztmp.docx
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiontest/ztmp.docx
Affected versions and remediation
This report applies to w-docx2pdf@1.0.27.
See all versions of w-docx2pdf for other recorded verdicts.
- Review the evidence and your use of w-docx2pdf@1.0.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.