w-docx2pdf@1.0.28
A tool for docx2pdf.
AI Security Review
scanned 12d ago · by lpm-firewall-aiThe automatic install hook fetches a native executable, and package code later launches it for a conversion request. The host is package-aligned and the launch is user-invoked, but the required binary fixture could not be resolved from source inspection; this supports a warning for an unresolved staged executable carrier, not a block.
Static reason
No blocking static signals were detected.
Trigger
The npm postinstall hook runs during installation; later, a caller invokes Microsoft Office conversion on Windows.
Impact
The package introduces and later runs a remotely fetched native executable; its behavior was not established from the inspected source.
Mechanism
The hook delegates to a downloader that retrieves cv.exe into the package source directory; the conversion path selects and executes it.
AI rationale
The automatic install hook fetches a native executable, and package code later launches it for a conversion request. The host is package-aligned and the launch is user-invoked, but the required binary fixture could not be resolved from source inspection; this supports a warning for an unresolved staged executable carrier, not a block.
Evidence
package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/autoDownloadFiles.mjssrc/WDocx2pdf.mjssrc/cv.exe
Network endpoints1
github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package runs a postinstall script that downloads an executable from a GitHub URL into the package source directory.
- The downloaded executable is later launched during Microsoft Office conversion when the caller invokes the conversion API.
- The required PDF fixture is binary and could not be resolved through source inspection, so a clean verdict is not supported.
Evidence against
- The inspected download host is the package's GitHub repository, and the executable launch is tied to a conversion request.
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrcPython/test.batView file
•path = srcPython/test.bat
kind = build_helper
sizeBytes = 23
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
srcPython/test.batView on unpkgtest/ztmp.docxView file
•path = test/ztmp.docx
kind = compressed_blob
sizeBytes = 514867
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
Findings
4 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/ztmpTrue.pdf
HighPayload In Excluded Dirtest/ztmpTrue.pdf
HighSemantic Analysis Limiteddist/w-docx2pdf.umd.js#virtual:normalized:round1
MediumNetwork
MediumShips Build HelpersrcPython/test.bat
MediumShips Compressed Blobtest/ztmp.docx
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectiontest/ztmp.docx
Affected versions and remediation
This report applies to w-docx2pdf@1.0.28.
See all versions of w-docx2pdf for other recorded verdicts.
- Review the evidence and your use of w-docx2pdf@1.0.28 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.