zireku-ls@1.0.7
Zireku License Shield & Environment Security Core
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe entrypoint is reachable as the package's public module and combines extensive string obfuscation with HTTP clients, hidden endpoint lists, and exported license-checking behavior. No install-time attack or concrete harmful action was verified, so the unresolved runtime risk warrants a warning rather than a block.
Decision evidence
public snapshot- package.json points the public module entry to lib/index.js and defines a prepublishOnly build script, with no install hook.
- lib/index.js begins with a string-table rotation loop and opaque decoder calls.
- The entrypoint imports Node HTTP clients and constructs obfuscated IP source and license endpoint lists.
- The entrypoint defines a fetchText helper and exports an asynchronous verifyLicense function, but the obfuscated code leaves request data, recipients, and conditions unresolved.
- The manifest shows no preinstall, install, or postinstall script.
- Static inspection did not establish a concrete harmful action or a decoded network recipient.
Source & flagged code
8 flaggedSource contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/index.jsView on unpkg · L1lib/index.js begins with a string-table rotation loop and opaque decoder calls.
lib/index.jsView on unpkg · L1The entrypoint imports Node HTTP clients and constructs obfuscated IP source and license endpoint lists.
lib/index.jsView on unpkg · L1Findings
Affected versions and remediation
This report applies to zireku-ls@1.0.7.
See all versions of zireku-ls for other recorded verdicts.
- Review the evidence and your use of zireku-ls@1.0.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.