zireku-ls@1.0.12
Zireku License Shield & Environment Security Core
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe entrypoint is extensively obfuscated despite containing network and license-verification functionality, and the inspected excerpts do not resolve its runtime data flow. The manifest shows only a prepublish build hook, so no install-time attack was established.
Static reason
One or more suspicious static signals were detected.
Trigger
Importing the package exposes its obfuscated runtime entrypoint; the inspected source does not establish which exported calls initiate network activity.
Impact
Unresolved runtime behavior creates review risk, but the inspected evidence does not establish credential theft, destructive activity, or another concrete attack.
Mechanism
HTTP and HTTPS imports, a fetch helper, and license-verification code are present, but obfuscation prevents confirmation of endpoint selection and transferred data.
AI rationale
The entrypoint is extensively obfuscated despite containing network and license-verification functionality, and the inspected excerpts do not resolve its runtime data flow. The manifest shows only a prepublish build hook, so no install-time attack was established.
Evidence
lib/index.js
Decision evidence
public snapshotAI called this Suspicious at 72.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The published entrypoint is a heavily obfuscated, single-line source file, so its runtime behavior cannot be reliably determined from these inspected excerpts.
- The entrypoint imports HTTP, HTTPS, and crypto modules and defines a network-fetch helper plus an exported license-verification function; their destination and data flow remain obscured.
- The package has a `prepublishOnly` build script, not an install-time lifecycle hook.
Evidence against
- The inspected manifest defines `lib/index.js` as the exported entrypoint and limits published files to `lib`.
- No concrete malicious action, recipient, or external endpoint was established from the inspected source.
Behavioral surface
HighEntropyStringsMinifiedPossibleObfuscationTrivial
Source & flagged code
6 flaggedlib/index.jsView file
1function _0x2b27fb(_0x28fdc0,_0x5b8104,_0x38df47,_0x4e6f26,_0x447a1c){const _0x1313bd={_0x154852:0x166};return _0x919f(_0x447a1c-_0x1313bd._0x154852,_0x28fdc0);}(function(_0x157c2a...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/index.jsView on unpkg · L11'u1uh','l8ogW4y','BhvK','W5v7ga','WQ/cHSof','zxnZ','WRWKW5y'];_0xebcd=function(){return _0x55441a;};return _0xebcd();}import _0xaa3479 from'node:http';import _0x509cc2 from'node:https';function _0x3d5567(_0x18e0e9,_0x393de2,_0x425d67,_0x13c20b,_0x48bb2f){const _0x328b8e={_0x1cc56f:0x28b};return _0x24ec(_0x48bb2f-_0x328
Medium
Ai Review Evidence
The published entrypoint is a heavily obfuscated, single-line source file, so its runtime behavior cannot be reliably determined from these inspected excerpts.
lib/index.jsView on unpkg · L1168,0x2dd,0x3ee)];function fetchText(_0x5ced64,_0x3d37e7=0x2*-0x1f1+0x13f7*-0x3+-0x1b*-0x385,_0x444936={}){const _0x40dfbc={_0x3617e6:0x201,_0x32855a:0x216,_0xd7d875:'3u]2',_0x20a45c:0x246,_0x3d18b1:0xef,_0x231d60:0x4f9,_0x11299e:0x679,_0x138ff1:0x55f,_0xdffb96
Medium
Ai Review Evidence
Findings
1 High6 Medium3 Low
HighObfuscated Payload Loaderlib/index.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
MediumSuspicious Lifecycle Evidencepackage.json
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to zireku-ls@1.0.12.
See all versions of zireku-ls for other recorded verdicts.
- Review the evidence and your use of zireku-ls@1.0.12 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.