registry / w-docx2pdf / 1.0.8

w-docx2pdf@1.0.8

A tool for docx2pdf.

AI Security Review

scanned 22d ago · by lpm-firewall-ai

Install-time code fetches an unpinned Windows executable into the package. Runtime conversion launches that fetched executable on user-provided documents.

Static reason

No blocking static signals were detected.

Trigger

npm install, then a Windows caller invoking WDocx2pdf in MicrosoftOffice mode.

Impact

A mutable remote binary can be substituted after publication and executed by package users.

Mechanism

postinstall remote executable download followed by child-process execution

Rationale

This is a concrete install-time remote-binary staging and later execution chain, but inspected source does not establish credential theft, destructive actions, or AI-agent control-surface abuse. It warrants a warning rather than a publish block.

Evidence

package.jsonscripts/install.mjssrc/downloadFiles.mjssrc/WDocx2pdf.mjssrcPython/cv.pysrc/cv.exe

Network endpoints1

github.com/yuda-lyu/w-docx2pdf/raw/refs/heads/master/src/cv.exe

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Dangerous Capability with low false-positive risk.

w-docx2pdf@1.0.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code