// npm 패키지

carvus-lens

Circle-to-Search for desktop — draw a circle on your screen to instantly search Google Lens, get AI answers, and translate text. Powered by Tesseract OCR and Groq AI.

npmjs.com tarball repo homepage

버전

메인테이너

라이선스

MIT

최초 publish

2026-05-16

publisher

aadil-fazal

tarball

364,873 B

AUTO-PUBLISHED·1개 버전 인덱싱됨·최근 publish: 2026-05-16

// exfil path

what is read → where it ships

steals

● AI API keys
○ clipboard

sends to

(no destination string extracted — payload may be dynamic / obfuscated)

evidence in excerpt

> const { execSync } = require('child_process');
> execSync(`"${electronPath}" "${appPath}"`, { stdio: 'inherit' });

→ view full payload

// offending code· @1.0.1· 2 files flagged

llm: benign · 0.85

→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).

@1.0.1·2026-05-16·AUTO-PUBLISHED·publisher: aadil-fazal
heuristic 75/100
static flags 3
llm benign (0.85) via ollama
new-publisher:10dhas-source-repoosv-flagged:MAL-2026-4505reads-ai-api-keysclipboard-accesschild-process-spawn
→ 의심 전송지 없음, 원격 실행 형태 없음 — 1 known-vendor host(s).
// NHI intent1 target·mixed harvest patterns·gate: always
- gh CLI token storegh-cli-hosts
```
const GROQ_API_KEY = "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"
```
Activation gate: fires on every run. Harvest style: mixed harvest patterns.

--- package/render.js (excerpt) --- const { ipcRenderer } = require('electron'); // ─── CONFIG ────────────────────────────────────────────────────────────────── const GROQ_API_KEY = "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"; const IMG_HOST_KEY = "6d207e02198a847aa98d0a2a901485a5"; // ─── DOM ───────────────────────────────────────────────────────────────────── const canvas = document.getElementById("captureCanvas"); const ctx = canvas.getContext("2d"); const resultPopup = document.getElementById("resultPopup"); const resultContent = document.getElementById("resultContent"); const loadingEl = document.getElementById("loading"); const loadingText = document.getElementById("loadingText"); const closeBtn = document.getElementById("closeBtn"); const actionBar = document.getElementById("actionBar"); const btnCopy = document.getElementById("btnCopy"); const btnRead = document.getElementById("btnRead"); const btnAskAI = document.getElementById("btnAskAI"); const btnTranslate = document.getElementById("btnTranslate"); const btnSearch = document.getElementById("btnSearch"); const gcseContainer = document.getElementById("gcseContainer"); const statusPill = document.getElementById("statusPill"); const statusText = document.getElementById("statusText"); const hintOverlay = document.getElementById("hintOverlay"); const edgeLighting = document.getElementById("edgeLighting"); const edgeLightCanvas = document.getElementById("edgeLightingCanvas" --- package/bin/cli.js (excerpt) --- #!/usr/bin/env node const { execSync } = require('child_process'); const path = require('path'); const electronPath = path.join(__dirname, '..', 'node_modules', '.bin', 'electron'); const appPath = path.join(__dirname, '..'); try { execSync(`"${electronPath}" "${appPath}"`, { stdio: 'inherit' }); } catch (e) { // App closed normally }