registry / z-deno-truth-bwhlsz / 2.0.0

z-deno-truth-bwhlsz@2.0.0

A test utility package

AI Security Review

scanned 21d ago · by lpm-firewall-ai

An unusual package metadata export runs setup.js at import time and drops a Deno handler. The dropped handler reads fixed sensitive paths and exposes their contents in its response.

Static reason

No blocking static signals were detected.

Trigger

Importing z-deno-truth-bwhlsz/package.json.

Impact

A consumer that deploys or executes /tmp/h.tsx could disclose challenge/application files.

Mechanism

Import-time staging of a filesystem-harvesting Deno handler.

Rationale

Source inspection confirms an import-time payload dropper and a handler designed to expose sensitive local files. The absence of lifecycle execution or direct networking supports a warning rather than an install-time block.

Evidence

package.jsonsetup.jsindex.js/tmp/h.tsx/readflag/flagserver/app/backdoor.tsx/entrypoint.sh

Decision evidence

public snapshot

AI called this Suspicious at 97.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

package.json maps the ./package.json export to setup.js.
setup.js executes on importing that export and writes /tmp/h.tsx.

z-deno-truth-bwhlsz@2.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code