zireku-ls@1.0.8
Zireku License Shield & Environment Security Core
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe manifest shows no install-time hook, and the inspected runtime names fit license validation. Deep obfuscation leaves the verifier's network behavior unresolved, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A caller invokes the exported license verifier.
Impact
The network recipient and any information sent or side effects remain unclear, so no concrete attack is confirmed.
Mechanism
The verifier runs an environment check and proceeds through obfuscated logic that includes a license server query.
AI rationale
The manifest shows no install-time hook, and the inspected runtime names fit license validation. Deep obfuscation leaves the verifier's network behavior unresolved, so this warrants a warning rather than a block.
Evidence
lib/index.js
Decision evidence
public snapshotAI called this Suspicious at 75.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json exposes lib/index.js as the package entry point; its prepublishOnly script runs a build.
- lib/index.js is heavily obfuscated, with encoded strings and indirect calls that obscure runtime behavior.
- lib/index.js imports both Node HTTP and HTTPS modules.
- lib/index.js exports a license verifier and defines a license server query.
- The verifier calls an execution environment check before proceeding through obfuscated logic.
Evidence against
- The inspected manifest has no install-time lifecycle hook; prepublishOnly runs the build.
Behavioral surface
HighEntropyStringsMinifiedPossibleObfuscationTrivial
Source & flagged code
8 flaggedlib/index.jsView file
1(function(_0x1c6207,_0x143c5b){const _0x55bedb={_0x1814a1:0xa4,_0x3e5af3:0x116,_0x59654e:0xa,_0x5b3a2c:0x34,_0x58f80c:0x122,_0x181910:0x84e,_0x186548:0x6c5,_0x35390a:0x5fa,_0x518df...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/index.jsView on unpkg · L11(function(_0x1c6207,_0x143c5b){const _0x55bedb={_0x1814a1:0xa4,_0x3e5af3:0x116,_0x59654e:0xa,_0x5b3a2c:0x34,_0x58f80c:0x122,_0x181910:0x84e,_0x186548:0x6c5,_0x35390a:0x5fa,_0x518dfb:0x6f2,_0x561f8f:0x
Medium
Ai Review Evidence
lib/index.js is heavily obfuscated, with encoded strings and indirect calls that obscure runtime behavior.
lib/index.jsView on unpkg · L11from'node:http';function _0x28ca5f(_0x14957a,_0x27fe7a,_0x2be45d,_0x4a5227,_0x10b1d6){const _0x33a5fa={_0x385d74:0x29c};return _0x1949(_0x4a5227-_0x33a5fa._0x385d74,_0x27fe7a);}im
Medium
Ai Review Evidence
lib/index.js imports both Node HTTP and HTTPS modules.
lib/index.jsView on unpkg · L1Findings
1 High8 Medium3 Low
HighObfuscated Payload Loaderlib/index.js
MediumStructural Risk Force Deep Review
MediumAi Review Evidencepackage.json
MediumAi Review Evidencepackage.json
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
MediumAi Review Evidencelib/index.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to zireku-ls@1.0.8.
See all versions of zireku-ls for other recorded verdicts.
- Review the evidence and your use of zireku-ls@1.0.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.