9alma-app@3.4.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

9alma-app@3.4.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

bin/9alma.jsView file

17const fs = require('fs'); L18: const { spawn } = require('child_process'); L19:

High

Child Process

Package source references child process execution.

bin/9alma.jsView on unpkg · L17

8Cross-file remote execution chain: bin/9alma.js spawns dist/app.js; helper contains network access plus dynamic code execution. L8: * - When the app needs to restart (e.g., after self-update), it calls process.exit(99). L9: * - The supervisor catches exit code 99 and re-spawns the child process. L10: * - Any other exit code (0, 1, SIGINT, etc.) is forwarded — supervisor exits too. ... L17: const fs = require('fs'); L18: const { spawn } = require('child_process'); L19: ... L21: L22: const distApp = path.join(__dirname, '..', 'dist', 'app.js'); L23: const srcApp = path.join(__dirname, '..', 'src', 'app.js'); ... L42: // check (otherwise it would re-detect the same version and loop). L43: const env = { ...process.env, _9ALMA_SUPERVISOR: '1' }; L44: if (restartCount > 0) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/9alma.jsView on unpkg · L8

15L16: const path = require('path'); L17: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/9alma.jsView on unpkg · L15

public/js/dashboard.jsView file

11'Content-Type': 'application/json', L12: 'X-Requested-With': 'XMLHttpRequest' L13: }; ... L16: const originalFetch = window.fetch; L17: window.fetch = function(url, options = {}) { L18: if (!options.headers) { ... L68: const response = await fetch('/api/profile'); L69: const data = await response.json(); L70: if (data.success && data.user) { ... L289: L290: navigator.clipboard.writeText(text).then(() => { L291: el.classList.add('copied');

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

public/js/dashboard.jsView on unpkg · L11

dist/crypto-utils.jsView file

1'use strict';(function(_0x14cd45,_0x1e1828){const _0x118c8a={_0x5583d8:0x137,_0x149339:0x124,_0x2a10ee:0x138,_0x3c3f10:0xfd,_0x2213e8:0xf8,_0x180205:0xd1,_0x8e0901:0xf6,_0x740ff3:0...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/crypto-utils.jsView on unpkg · L1

Source & flagged code

5 flagged

bin/9alma.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * 9alma - Activation & License Management Assistant

4 * CLI Entry Point with Supervisor (auto-restart after update)

5 *

6 * Architecture:

7 * - This file is the SUPERVISOR — it spawns the actual app as a child process.

8 * - When the app needs to restart (e.g., after self-update), it calls process.exit(99).

9 * - The supervisor catches exit code 99 and re-spawns the child process.

10 * - Any other exit code (0, 1, SIGINT, etc.) is forwarded — supervisor exits too.

11 *

12 * This pattern enables true in-place auto-restart on Windows (which has no exec syscall).

13 */

14'use strict';

15

16const path = require('path');

17const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/9alma.jsView on unpkg · L15

18const { spawn } = require('child_process');

19

High

Child Process

Package source references child process execution.

bin/9alma.jsView on unpkg · L17

20const RESTART_EXIT_CODE = 99;

21

22const distApp = path.join(__dirname, '..', 'dist', 'app.js');

23const srcApp = path.join(__dirname, '..', 'src', 'app.js');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/9alma.jsView on unpkg · L8

24

25let appPath = null;

26if (fs.existsSync(distApp)) {

27 appPath = distApp;

28} else if (fs.existsSync(srcApp)) {

29 appPath = srcApp;

30} else {

31 console.error('[9alma] FATAL: Cannot find application entry point.');

32 console.error('[9alma] Expected: dist/app.js (production) or src/app.js (development)');

33 console.error('[9alma] Try: npm install -g 9alma-app@latest --prefer-online');

34 process.exit(1);

35}

36

37let restartCount = 0;

public/js/dashboard.jsView file

Lines 1-31javascript

1// Global variables

2let countdownInterval = null;

3let tokenCheckInterval = null;

4let accountsLiveInterval = null; // Periodic API refresh for accounts/token pages

5let accountsCountdownInterval

dist/crypto-utils.jsView file

Lines 1-1javascript

1'use strict';(function(_0x14cd45,_0x1e1828){const _0x118c8a={_0x5583d8:0x137,_0x149339:0x124,_0x2a10ee:0x138,_0x3c3f10:0xfd,_0x2213e8:0xf8,_0x180205:0xd1,_0x8e0901:0xf6,_0x740ff3:0xea