github.com / lddubeau

lddubeau/saxes

TypeScript·80 files·commit 4968bd0·scanned 18h ago·cached ✓

20/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

verdict accurate?

threat-state: lowlive

FINDINGS ░▒▓

infoSuspicious file in repoVery large source file (492KB) — could contain obfuscated payloadpackage-lock.json+2

warningPossible typosquat: tsd"tsd" is only 1 character(s) away from the popular package "tsx". This is a common supply-chain attack vector.package.json+4

warningPossible typosquat: tslint"tslint" is only 1 character(s) away from the popular package "eslint". This is a common supply-chain attack vector.package.json+4

infoAuthor has no other public repositoriesGitHub user "renovate[bot]" has no other public repositories, common for burner accounts used in scams.+2

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

66 files scanned @ 4968bd0 | 10/29/2026 | heuristic scan — always review manually

risk by category

code execution0

network & exfiltration0

file system access0

obfuscation0

supply chain12

owasp / injection0

telemetry

files 66/80rules hit 4engine v7commit 4968bd0

github

lddubeau/saxes

An evented streaming XML parser in JavaScript

TypeScript

3020d

80 files

66 scanned(83%)

4968bd0

architecture░▒▓

entry (0) flagged (0) pkg (14)

75 nodes · 66 edgesscroll to zoom · click node to jump to finding