9alma-app@3.4.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

9alma-app@3.4.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/9alma.jsView file

17const fs = require('fs'); L18: const { spawn } = require('child_process'); L19:

High

Child Process

Package source references child process execution.

bin/9alma.jsView on unpkg · L17

8Cross-file remote execution chain: bin/9alma.js spawns dist/app.js; helper contains network access plus dynamic code execution. L8: * - When the app needs to restart (e.g., after self-update), it calls process.exit(99). L9: * - The supervisor catches exit code 99 and re-spawns the child process. L10: * - Any other exit code (0, 1, SIGINT, etc.) is forwarded — supervisor exits too. ... L17: const fs = require('fs'); L18: const { spawn } = require('child_process'); L19: ... L21: L22: const distApp = path.join(__dirname, '..', 'dist', 'app.js'); L23: const srcApp = path.join(__dirname, '..', 'src', 'app.js'); ... L42: // check (otherwise it would re-detect the same version and loop). L43: const env = { ...process.env, _9ALMA_SUPERVISOR: '1' }; L44: if (restartCount > 0) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/9alma.jsView on unpkg · L8

15L16: const path = require('path'); L17: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/9alma.jsView on unpkg · L15

dist/db.jsView file

1'use strict';(function(_0x36212b,_0xd22bd0){const _0x38a23b={_0x2596f5:0x20b,_0x32e306:0x1b6,_0x2c329f:0x296,_0x2704d1:0xd8,_0x1f629d:0x10f,_0x498110:0x13e,_0x4ae04e:0x6f,_0x405af7...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/db.jsView on unpkg · L1

public/js/dashboard.jsView file

11'Content-Type': 'application/json', L12: 'X-Requested-With': 'XMLHttpRequest' L13: }; ... L16: const originalFetch = window.fetch; L17: window.fetch = function(url, options = {}) { L18: if (!options.headers) { ... L68: const response = await fetch('/api/profile'); L69: const data = await response.json(); L70: if (data.success && data.user) { ... L289: L290: navigator.clipboard.writeText(text).then(() => { L291: el.classList.add('copied');

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

public/js/dashboard.jsView on unpkg · L11

dist/crypto-utils.jsView file

1'use strict';(function(_0x103e6f,_0x3e951e){const _0xe3892a={_0x231c34:0x28,_0x162b6a:0x94,_0x380dc0:0x1c,_0x567402:0x6b,_0x36bd96:0x78,_0x297782:0x86,_0x8a48e5:0x68,_0x5123ab:0x52...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/crypto-utils.jsView on unpkg · L1

Source & flagged code

6 flagged

bin/9alma.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2/**

3 * 9alma - Activation & License Management Assistant

4 * CLI Entry Point with Supervisor (auto-restart after update)

5 *

6 * Architecture:

7 * - This file is the SUPERVISOR — it spawns the actual app as a child process.

8 * - When the app needs to restart (e.g., after self-update), it calls process.exit(99).

9 * - The supervisor catches exit code 99 and re-spawns the child process.

10 * - Any other exit code (0, 1, SIGINT, etc.) is forwarded — supervisor exits too.

11 *

12 * This pattern enables true in-place auto-restart on Windows (which has no exec syscall).

13 */

14'use strict';

15

16const path = require('path');

17const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/9alma.jsView on unpkg · L15

18const { spawn } = require('child_process');

19

High

Child Process

Package source references child process execution.

bin/9alma.jsView on unpkg · L17

20const RESTART_EXIT_CODE = 99;

21

22const distApp = path.join(__dirname, '..', 'dist', 'app.js');

23const srcApp = path.join(__dirname, '..', 'src', 'app.js');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/9alma.jsView on unpkg · L8

24

25let appPath = null;

26if (fs.existsSync(distApp)) {

27 appPath = distApp;

28} else if (fs.existsSync(srcApp)) {

29 appPath = srcApp;

30} else {

31 console.error('[9alma] FATAL: Cannot find application entry point.');

32 console.error('[9alma] Expected: dist/app.js (production) or src/app.js (development)');

33 console.error('[9alma] Try: npm install -g 9alma-app@latest --prefer-online');

34 process.exit(1);

35}

36

37let restartCount = 0;

dist/db.jsView file

Lines 1-1javascript

1'use strict';(function(_0x36212b,_0xd22bd0){const _0x38a23b={_0x2596f5:0x20b,_0x32e306:0x1b6,_0x2c329f:0x296,_0x2704d1:0xd8,_0x1f629d:0x10f,_0x498110:0x13e,_0x4ae04e:0x6f,_0x405af7:0x64,_0x4cc4e1:

public/js/dashboard.jsView file

Lines 1-31javascript

1// Global variables

2let countdownInterval = null;

3let tokenCheckInterval = null;

4let accountsLiveInterval = null; // Periodic API refresh for accounts/token pages

5let accountsCountdownInterval

dist/crypto-utils.jsView file

Lines 1-1javascript

1'use strict';(function(_0x103e6f,_0x3e951e){const _0xe3892a={_0x231c34:0x28,_0x162b6a:0x94,_0x380dc0:0x1c,_0x567402:0x6b,_0x36bd96:0x78,_0x297782:0x86,_0x8a48e5:0x68,_0x5123ab:0x52