Loading npm security reports…

4bnode@4.1.9: Clean npm security report (Allow) | LPM Firewall

registry / 4bnode / 4.1.9

4bnode@4.1.9

4bnode is a CLI-powered backend development platform with a built-in visual dashboard to generate, manage, and test Node.js/Express APIs faster.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

No confirmed malicious install-time or import-time behavior. The package is an explicit CLI/project generator; its generated local dashboard can write project files and install dependencies only after user commands or authenticated local dashboard actions.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit `4bnode init`/feature command or use of the generated local `/_dev` dashboard.

Impact

Writes within the selected/generated project and makes optional user-configured network requests; no unconsented package-host mutation was found.

Mechanism

User-invoked project scaffolding, dashboard administration, and optional provider integrations.

Rationale

The flagged execution, network, and environment operations are aligned with an explicit scaffolding CLI and a locally restricted development dashboard. The legacy passkey helper and official-domain notification are concerning design choices, but neither establishes malicious behavior or unconsented execution/exfiltration.

Evidence

package.jsonindex.jsscripts/reveal-passkey.mjsskeleton/index.jsskeleton/.4bnode/dev-api.jsskeleton/.4bnode/codegen.jsskeleton/.4bnode/ui.htmlskeleton/.envskeleton/src/services/mailer.js

Network endpoints3

api.openai.com/v1/chat/completions/v1/messages

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with medium false-positive risk.

Evidence for block

`scripts/reveal-passkey.mjs` brute-forces legacy numeric SHA-256 passkeys when explicitly run against a supplied app path.
`skeleton/.4bnode/dev-api.js` reports host, OS-user, app name, and sender address only after an authorized `4brains.in` mail setup.
`skeleton/.4bnode/ui.html` loads dashboard libraries from `esm.sh` at dashboard runtime.

Evidence against

`package.json` has only `prepublishOnly`; no preinstall/install/postinstall hook is present.
`index.js` runs copying and `npm install` only for the explicit `4bnode init` command.
`skeleton/.4bnode/dev-api.js` disables the dashboard in production by default and restricts it to loopback unless explicitly enabled remotely.
AI requests target documented provider APIs and use project-configured keys only after dashboard use.
No AI-agent control-surface paths or unrelated credential/file harvesting were found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

8 flagged

skeleton/.envView file

•patternName = blocked_file severity = critical matchedText = skeleton/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skeleton/.envView on unpkg

index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from "fs";

4import path from "path";

5import crypto from "crypto";

6import { execSync, execFileSync } from "child_process";

7import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L5

8import chalk from "chalk";

9import { input, select, password } from "@inquirer/prompts";

10import { sanitizeName } from "./lib/names.js";

11import {

12 checkMongoConfig,

13 checkRoutesDir,

14 checkModelsExist,

15 listModels,

16 listRoutes,

17 getModelSchemaDetailed,

18} from "./lib/project.js";

19import {

20 showBanner,

21 createSpinner,

22 showSuccess,

23 showNextSteps,

24 showError,

25 showHeader,

Lines 37-77javascript

37 }

38 fs.readdirSync(src).forEach((child) => {

39 copyRecursiveSync(path.join(src, child), path.join(dest, child));

40 });

41 } else {

42 fs.copyFileSync(src, dest);

•matchType = previous_version_dangerous_delta matchedPackage = 4bnode@4.1.8 matchedIdentity = npm:NGJub2Rl:4.1.8 similarity = 0.909 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

scripts/audit-dev-surface.mjsView file

Lines 16-56javascript

16import fs from 'fs';

17import path from 'path';

18import crypto from 'crypto';

20const args =

add-email.jsView file

Lines 14-54javascript

14 buildMailerService,

15 isOfficialMailDomain,

16 OFFICIAL_MAIL_DOMAIN_PASSWORD,

17 OFFICIAL_MAIL_NOTIFY,

18} from "./lib/codegen.js";

20// The 4brains.in domain can't be configured directly — require the shared

21// authorization password (exits on a wrong answer).

22async

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View file

•path = skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2 kind = high_entropy_blob sizeBytes = 208184 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View on unpkg

Source & flagged code

8 flagged · loading source

skeleton/.envView file

•patternName = blocked_file severity = critical matchedText = skeleton/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skeleton/.envView on unpkg

index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

5import crypto from "crypto"; L6: import { execSync, execFileSync } from "child_process"; L7: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

index.js

Findings

2 Critical4 High5 Medium6 Low

CriticalCritical Secretskeleton/.env

CriticalPrevious Version Dangerous Deltaindex.js

HighChild Processindex.js

HighShell

HighRuntime Package Installindex.js

HighShips High Entropy Blobskeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2

MediumDynamic Requireadd-email.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patternadd-email.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalscripts/audit-dev-surface.mjs

Source & flagged code

8 flagged

skeleton/.envView file

•patternName = blocked_file severity = critical matchedText = skeleton/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skeleton/.envView on unpkg

index.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from "fs";

4import path from "path";

5import crypto from "crypto";

6import { execSync, execFileSync } from "child_process";

7import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L5

8import chalk from "chalk";

9import { input, select, password } from "@inquirer/prompts";

10import { sanitizeName } from "./lib/names.js";

11import {

12 checkMongoConfig,

13 checkRoutesDir,

14 checkModelsExist,

15 listModels,

16 listRoutes,

17 getModelSchemaDetailed,

18} from "./lib/project.js";

19import {

20 showBanner,

21 createSpinner,

22 showSuccess,

23 showNextSteps,

24 showError,

25 showHeader,

Lines 37-77javascript

37 }

38 fs.readdirSync(src).forEach((child) => {

39 copyRecursiveSync(path.join(src, child), path.join(dest, child));

40 });

41 } else {

42 fs.copyFileSync(src, dest);

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

index.jsView on unpkg

scripts/audit-dev-surface.mjsView file

Lines 16-56javascript

16import fs from 'fs';

17import path from 'path';

18import crypto from 'crypto';

20const args =

add-email.jsView file

Lines 14-54javascript

14 buildMailerService,

15 isOfficialMailDomain,

16 OFFICIAL_MAIL_DOMAIN_PASSWORD,

17 OFFICIAL_MAIL_NOTIFY,

18} from "./lib/codegen.js";

20// The 4brains.in domain can't be configured directly — require the shared

21// authorization password (exits on a wrong answer).

22async

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View file

•path = skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2 kind = high_entropy_blob sizeBytes = 208184 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skeleton/.4bnode/assets/fonts/NotoSans-SemiBold.woff2View on unpkg

Lines 87-127javascript

87 let notifyCtx = null; // set when an authorized 4brains.in sender is configured

89 if (preset.type === "resend") {

90 // IntraApp(Postmaster) → Resend API. Only an API key + from address.

91 const apiKey = (await password({ message: "Resend API key (re_...):", mask: "*" })).trim();

92 const from = (await input({ message: "From address:", default: "" })).trim();

93 await ensureOfficialAllowed(from);

94 if (isOfficialMailDomain(from)) updateEnvFile(envPath, "OFFICIAL_MAIL_AUTHORIZED", "1");

95 if (apiKey) updateEnvFile(envPath, "RESEND_API_KEY", apiKey);

96 if (from) updateEnvFile(envPath, "MAIL_FROM", from);

97 dep = "resend";

98 summary.push(from ? `From: ${from}` : "From: (set MAIL_FROM in .env)");

99 if (isOfficialMailDomain(from) && apiKey) notifyCtx = { kind: "resend", from, apiKey };

100 } else {

101 // Custom SMTP → nodemailer. TLS selects the port (465 vs 587).

102 const host = (await input({ message: "SMTP host:", default: preset.host || "" })).trim();

103 const secure = await confirm({ message: "Use TLS (port 465)? (No = port 587)", default: false });

104 const defPort = secure ? 465 : 587;

105 const port = (await input({ message: "SMTP port:", default: String(defPort) })).trim();

106 const user = (await input({ message: "SMTP user:", default: "" })).trim();

107 const pass = (await password({ message: "SMTP password:", mask: "*" })).trim();

Medium

Secret Pattern

Hardcoded password in add-email.js

add-email.jsView on unpkg · L107

108 const from = (await input({ message: "From address:", default: user })).trim();

109 await ensureOfficialAllowed(from || user);

110 if (isOfficialMailDomain(from || user)) updateEnvFile(envPath, "OFFICIAL_MAIL_AUTHORIZED", "1");

111 updateEnvFile(envPath, "SMTP_HOST", host);

112 updateEnvFile(envPath, "SMTP_PORT", port || String(defPort));

113 updateEnvFile(envPath, "SMTP_SECURE", secure ? "true" : "false");

114 updateEnvFile(envPath, "SMTP_USER", user);

115 if (pass) updateEnvFile(envPath, "SMTP_PASS", pass);

116 updateEnvFile(envPath, "SMTP_FROM", from || user);

117 dep = "nodemailer";

118 summary.push(`Host: ${host}:${port || defPort}`);

119 if (isOfficialMailDomain(from || user)) notifyCtx = { kind: "smtp", from: from || user, smtp: { host, port: port || defPort, secure, user, pass } };

120 }

121

122 console.log();

123 showFileAction("updated", ".env");

124

125 fs.mkdirSync(dir, { recursive: true });

126 // Rewrite the mailer only if missing or on the old single-backend version.

127 if (!fs.existsSync(mailerPath) || !fs.readFileSync(mailerPath, "utf8").includes("MAIL_PROVIDER")) {