registry / w-docx2pdf / 1.0.29
w-docx2pdf@1.0.29
⚠ Under reviewA tool for docx2pdf.
AI Security Review
scanned 3d ago · by lpm-firewall-aiVerified text source was inspected, but required binary or non-UTF8 files remain unresolved: test/ztmpTrue.pdf. A clean verdict cannot be grounded.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
AI rationale
Verified text source was inspected, but required binary or non-UTF8 files remain unresolved: test/ztmpTrue.pdf. A clean verdict cannot be grounded.
Decision evidence
public snapshotAI called this Manual Review at 50.0% confidence as Unknown with medium false-positive risk.
AI review observations
- The manifest’s postinstall hook runs the package installer.
- The installer acts only when its path is inside node_modules, then calls the package downloader.
- The downloader retrieves cv.exe from the project’s GitHub repository and writes it under the package source directory.
- The Windows conversion path locates that executable, passes it the selected input and output paths, and runs it for conversion.
- The bundled Python source uses docx2pdf to convert the supplied input file to the supplied output file.
- The test uses test/ztmpTrue.pdf only as an output-size reference; offline analysis could not structurally identify the artifact.
Evidence against
Behavioral surface
ChildProcessCryptoEvalFilesystemNetwork
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
8 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrcPython/test.batView file
•path = srcPython/test.bat
kind = build_helper
sizeBytes = 23
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
srcPython/test.batView on unpkgtest/ztmp.docxView file
•path = test/ztmp.docx
kind = compressed_blob
sizeBytes = 514867
magicHex = [redacted]
Medium
Ships Compressed Blob
Package ships compressed or archive-like blobs.
Findings
5 High4 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighShips High Entropy Blobtest/ztmpTrue.pdf
HighPayload In Excluded Dirtest/ztmpTrue.pdf
HighSemantic Analysis Limiteddist/w-docx2pdf.umd.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/w-docx2pdf.umd.js
MediumNetwork
MediumShips Build HelpersrcPython/test.bat
MediumShips Compressed Blobtest/ztmp.docx
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to w-docx2pdf@1.0.29.
See all versions of w-docx2pdf for other recorded verdicts.
- Review the evidence and your use of w-docx2pdf@1.0.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.