9remote@2.5.5: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

9remote@2.5.5: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/install.cjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/install.cjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.cjsView file

2const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var f=Object.create;var l=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var h=Object.getOwnPropertyNames;var p=Object.getPrototypeOf,b=Object.prototype.hasOwnProperty...

High

Child Process

Package source references child process execution.

dist/install.cjsView on unpkg · L2

dist/ptyDaemon.cjsView file

2const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var Z=Object.create;var q=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty... L4: `;try{a.default.appendFileSync(R,n)}catch{}console.error(n.trim())}function le(){return process.env.CODESPACES==="true"?process.env.CODESPACE_VSCODE_FOLDER||"/workspaces":process.e...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/ptyDaemon.cjsView on unpkg · L2

1#!/usr/bin/env node L2: const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var Z=Object.create;var q=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ptyDaemon.cjsView on unpkg · L1

2const __importMetaUrl = require('url').pathToFileURL(__filename).href; L3: var Z=Object.create;var q=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var J=Object.getOwnPropertyNames;var V=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty... L4: `;try{a.default.appendFileSync(R,n)}catch{}console.error(n.trim())}function le(){return process.env.CODESPACES==="true"?process.env.CODESPACE_VSCODE_FOLDER||"/workspaces":process.e... L5: `,c+=`[ -f "${o}/.zshrc" ] && source "${o}/.zshrc" ... L8: `,a.default.writeFileSync(i,c),r.ZDOTDIR=s}else if(n){let i=r.PROMPT_COMMAND||"";r.PROMPT_COMMAND=`printf "\\e]7;file://%s\\a" "\${HOSTNAME}\${PWD}"${i?`; ${i}`:""}`}return/cmd\.ex... L9: `;for(let t of v)try{t.write(r)}catch{}}function h(e,r){try{e.write(JSON.stringify(r)+` L10: `)}ca

dist/server.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = 9remote@2.0.70 matchedIdentity = npm:OXJlbW90ZQ:2.0.70 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.cjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/server.cjs: `);return s!==-1&&(e=hR(e,i,n,s)),n+e+i};Object.defineProperties(Iu.prototype,Qa);h5=Iu(),Eye=Iu({level:gR?gR.level:0}),Pu=h5});var Lo={};sn(Lo,{createRouter:()=>a0,jsonErr:()=>Be,... `).filter(Boolean).slice(-t)}catch{return[]}}function DR(){try{ri.default.writeFileSync(Fu,"")}catch{}}function tt(t){return{debug:(...e)=>{T5&&tc(t,"debug",Bh(e))},info:(...e)=>tc... `);function a(c){var l=K0(Ki.join(c,"prebuilds")).map(cO),u=l.filter(lO(z0,G0)).sort(uO)[0];if(u){var f=Ki.join(c,"prebuilds",u.name),h=K0(f).map(fO),m=h.filter(pO(W0,eO)),d=m.sort... `+r)}function Wo(t,e,r,n,i,s){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.cap

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/server.cjsView on unpkg

89L90: `;for(let n of Em)try{n.write(r)}catch{Em.delete(n)}}function _e(t){Wt("log",{message:`[${new Date().toLocaleTimeString(void 0,{hour12:!1})}] ${t}`})}function WP(){return ls}functi... L91: ... L99: L100: `),Em.add(e),t.on("close",()=>Em.delete(e))}function eN(t,e){ce(e,{...ls,...li,desktopEnabled:Yr,remoteAvailable:Xx,transport:Qx()})}async function tN(t,e){let{parseJsonBody:r}=awa... L101: `),!0}catch(e){return console.error("[DaemonClient] Send error:",e),!1}}function tl(t,e=5e3){return new Promise((r,n)=>{let i=uJ();t.requestId=i;let s=setTimeout(()=>{el.delete(i),... ... L103: `);if(o!==-1){clearTimeout(i);try{let a=JSON.parse(r.slice(0,o));n(a.version||"unknown")}catch{n(null)}}}),e.on("error",()=>{clearTimeout(i),n(null)})})}async function mJ(){try{let... L104: `);hw=n.p

dist/assets/tray.ps1View file

•path = dist/assets/tray.ps1 kind = build_helper sizeBytes = 4280 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/assets/tray.ps1View on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-41json

1{

2 "name": "9remote",

3 "version": "2.5.5",

4 "type": "module",

5 "description": "Remote terminal access from anywhere",

6 "main": "dist/server.cjs",

7 "bin": {

8 "9remote": "./dist/cli.cjs"

9 },

10 "scripts": {

11 "start": "node cli/index.js",

12 "ui": "node cli/index.js ui",

13 "dev": "NODE_ENV=development nodemon cli/index.js",

14 "dev:ui": "npm-run-all --parallel dev:ui:run dev:vite:wait",

15 "dev:vite": "vite",

16 "dev:vite:wait": "wait-on http://localhost:2208/api/health && vite",

17 "dev:ui:run": "NODE_ENV=development node cli/index.js ui",

18 "dev:ui:start": "npm-run-all --parallel dev:ui:run:start dev:vite:wait",

19 "dev:ui:run:start": "NODE_ENV=development node cli/index.js ui --start",

20 "build:ui": "vite build",

21 "postinstall": "node dist/install.cjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 },

23 "files": [

24 "dist/"

25 ],

26 "keywords": [

27 "remote",

28 "terminal",

29 "ssh",

30 "cli"

31 ],

32 "license": "MIT",

33 "dependencies": {

34 "archiver": "^5.3.2",

35 "bufferutil": "4.1.0",

36 "chalk": "^5.4.1",

37 "chokidar": "^3.6.0",

38 "edge-tts-node": "^1.5.7",

39 "http-proxy": "^1.18.1",

40 "inquirer": "^9.3.8",

41 "koffi": "^2.16.3",

dist/install.cjsView file

Lines 1-4javascript

1#!/usr/bin/env node

2const __importMetaUrl = require('url').pathToFileURL(__filename).href;

3var f=Object.create;var l=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;

dist/ptyDaemon.cjsView file

Lines 1-12javascript

1#!/usr/bin/env node

2const __importMetaUrl = require('url').pathToFileURL(__filename).href;

3var Z=Object.create;var q=Object.defineProperty;var W=

dist/server.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = 9remote@2.0.70 matchedIdentity = npm:OXJlbW90ZQ:2.0.70 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/server.cjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/server.cjs: `);return s!==-1&&(e=hR(e,i,n,s)),n+e+i};Object.defineProperties(Iu.prototype,Qa);h5=Iu(),Eye=Iu({level:gR?gR.level:0}),Pu=h5});var Lo={};sn(Lo,{createRouter:()=>a0,jsonErr:()=>Be,... `).filter(Boolean).slice(-t)}catch{return[]}}function DR(){try{ri.default.writeFileSync(Fu,"")}catch{}}function tt(t){return{debug:(...e)=>{T5&&tc(t,"debug",Bh(e))},info:(...e)=>tc... `);function a(c){var l=K0(Ki.join(c,"prebuilds")).map(cO),u=l.filter(lO(z0,G0)).sort(uO)[0];if(u){var f=Ki.join(c,"prebuilds",u.name),h=K0(f).map(fO),m=h.filter(pO(W0,eO)),d=m.sort... `+r)}function Wo(t,e,r,n,i,s){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.cap

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/server.cjsView on unpkg

89L90: `;for(let n of Em)try{n.write(r)}catch{Em.delete(n)}}function _e(t){Wt("log",{message:`[${new Date().toLocaleTimeString(void 0,{hour12:!1})}] ${t}`})}function WP(){return ls}functi... L91: ... L99: L100: `),Em.add(e),t.on("close",()=>Em.delete(e))}function eN(t,e){ce(e,{...ls,...li,desktopEnabled:Yr,remoteAvailable:Xx,transport:Qx()})}async function tN(t,e){let{parseJsonBody:r}=awa... L101: `),!0}catch(e){return console.error("[DaemonClient] Send error:",e),!1}}function tl(t,e=5e3){return new Promise((r,n)=>{let i=uJ();t.requestId=i;let s=setTimeout(()=>{el.delete(i),... ... L103: `);if(o!==-1){clearTimeout(i);try{let a=JSON.parse(r.slice(0,o));n(a.version||"unknown")}catch{n(null)}}}),e.on("error",()=>{clearTimeout(i),n(null)})})}async function mJ(){try{let... L104: `);hw=n.p

dist/assets/tray.ps1View file

•path = dist/assets/tray.ps1 kind = build_helper sizeBytes = 4280 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/assets/tray.ps1View on unpkg