Multiple vulnerabilities detected: excessive bitwise math, potential DoS via regex, and arbitrary code execution via Function.prototype.apply.
No verification record available.
The package exhibits multiple concerning behaviors. Firstly, the YARA rule 'unsigned_bitwise_math_excess' is triggered in both flow.js and flow.mjs, indicating potentially suspicious use of bitwise operations. Secondly, the LLM analysis identifies a potential denial-of-service vulnerability in flow.js due to catastrophic backtracking in a regular expression. Finally, multiple LLM analyses highlight potential arbitrary code execution vulnerabilities in flow.mjs through the use of Function.prototype.apply. The combination of these factors suggests a high risk of malicious activity.
