zireku-ls@1.0.1
Zireku License Shield & Environment Security Core
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe package exports a highly obfuscated entrypoint with network-capable imports and environment access, but the inspected source does not establish a concrete malicious action. This unresolved runtime risk warrants a warning.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading the package entrypoint or calling its exported functions; the exact activation path is obscured.
Impact
Unresolved; the inspected source does not establish what data or system behavior is affected.
Mechanism
Obfuscated code imports HTTP and HTTPS clients and accesses process environment data. The inspected excerpts do not resolve the requests, data flow, or conditions.
AI rationale
The package exports a highly obfuscated entrypoint with network-capable imports and environment access, but the inspected source does not establish a concrete malicious action. This unresolved runtime risk warrants a warning.
Evidence
lib/index.js
Decision evidence
public snapshotAI called this Suspicious at 78.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- package.json exposes lib/index.js as the package entrypoint and declares no lifecycle scripts.
- lib/index.js begins with heavily obfuscated code and imports both HTTP client modules.
- The entrypoint reads process environment data in obfuscated code; its purpose and effects are unresolved.
Evidence against
- No install-time lifecycle hook is declared in package.json; the identified behavior requires loading the exported entrypoint.
Behavioral surface
HighEntropyStringsMinifiedPossibleObfuscationTrivial
Source & flagged code
5 flaggedlib/index.jsView file
1(function(_0x3d0885,_0x1c8423){const _0xfe4a3c={_0x4ec64e:0x36a,_0x2a4081:0x2a3,_0x233483:0x235,_0xe5f4aa:0x264,_0x48925c:0x396,_0x3f0378:0x275,_0x4f22fc:'^o)p',_0x143f43:0x1fc,_0x...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/index.jsView on unpkg · L11(function(_0x3d0885,_0x1c8423){const _0xfe4a3c={_0x4ec64e:0x36a,_0x2a4081:0x2a3,_0x233483:0x235,_0xe5f4aa:0x264,_0x48925c:0x396,_0x3f0378:0x275,_0x4f22fc:'^o)p',_0x143f43:0x1fc,_0x
Medium
Ai Review Evidence
lib/index.js begins with heavily obfuscated code and imports both HTTP client modules.
lib/index.jsView on unpkg · L11https';function _0x19879c(_0x3979f6,_0x3f8433,_0x314788,_0x1fad46,_0x57baf0){const _0x35cbff={_0x3a1c5e:0x290};return _0x4f31(_0x57baf0- -_0x35cbff._0x3a1c5e,_0x1fad46);}function _0x409431(_0x3df7bb,_0x11e45d,_0x276cef,_0x300a1d,_0x3a0cf9){const _0x1
Medium
Ai Review Evidence
lib/index.js begins with heavily obfuscated code and imports both HTTP client modules.
lib/index.jsView on unpkg · L1Findings
1 High5 Medium1 Low
HighObfuscated Payload Loaderlib/index.js
MediumStructural Risk Force Deep Review
MediumSuspicious Lifecycle Evidencepackage.json
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
LowHigh Entropy Strings
Affected versions and remediation
This report applies to zireku-ls@1.0.1.
See all versions of zireku-ls for other recorded verdicts.
- Review the evidence and your use of zireku-ls@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.