@adep/cli@0.1.4: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@adep/cli@0.1.4: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/index.jsView file

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L49: const raw = await readFile(paths.credentialsFile, "utf8"); L50: const parsed = JSON.parse(raw); L51: if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") { ... L166: headers: { "content-type": "application/json" }, L167: body: JSON.stringify({ email: input.email, password: input.password }) L168: });

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L12

42if (mode !== 384) { L43: const { chmod } = await import("node:fs/promises"); L44: await chmod(file, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L42

12// packages/cli/src/config.ts L13: function resolvePaths(env = process.env) { L14: const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`; ... L17: function resolveServer(env = process.env) { L18: return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, ""); L19: } ... L49: const raw = await readFile(paths.credentialsFile, "utf8"); L50: const parsed = JSON.parse(raw); L51: if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") { ... L166: headers: { "content-type": "application/json" }, L167: body: JSON.stringify({ email: input.email, password: input.password }) L168: });

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/index.jsView on unpkg · L12

package.jsonView file

6"bin": { "adep": "./dist/index.js" }, "exports": { ".": {

Low

Suspicious Lifecycle Evidence

The manifest exposes a CLI and contains no install lifecycle hook.

package.jsonView on unpkg · L6

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-62javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res) => function __init() {

5 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

6};

7var __export = (target, all) => {

8 for (var name in all)

9 __defProp(target, name, { get: all[name], enumerable: true });

10};

11

12// packages/cli/src/config.ts

13function resolvePaths(env = process.env) {

14 const home = env["ADEP_HOME"] ?? `${env["HOME"] ?? ""}/.adep`;

15 return { home, credentialsFile: `${home}/credentials` };

16}

17function resolveServer(env = process.env) {

18 return (env["ADEP_SERVER"] ?? "https://adep.jajabjbj.top").replace(/\/+$/, "");

19}

20var init_config = __esm({

21 "packages/cli/src/config.ts"() {

22 "use strict";

23 }

24});

25

26// packages/cli/src/credentials.ts

27import { mkdir, open, readFile, rm, stat } from "node:fs/promises";

28import { dirname } from "node:path";

29async function saveCredentials(paths, credentials) {

30 await mkdir(dirname(paths.credentialsFile), { recursive: true });

31 const handle = await open(paths.credentialsFile, "w", 384);

32 try {

33 await handle.writeFile(JSON.stringify(credentials, null, 2));

34 } finally {

35 await handle.close();

36 }

37 await chmodStrict(paths.credentialsFile);

38}

39async function chmodStrict(file) {

40 const info = await stat(file);

41 const mode = info.mode & 511;

42 if (mode !== 384) {

43 const { chmod } = await import("node:fs/promises");

44 await chmod(file, 384);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L42

45 }

46}

47async function loadCredentials(paths) {

48 try {

49 const raw = await readFile(paths.credentialsFile, "utf8");

50 const parsed = JSON.parse(raw);

51 if (typeof parsed["server"] !== "string" || typeof parsed["email"] !== "string" || typeof parsed["encodedToken"] !== "string") {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.js

52 return null;

53 }

54 return {

55 server: parsed["server"],

56 email: parsed["email"],

57 encodedToken: parsed["encodedToken"]

58 };

59 } catch {

60 return null;

61 }

62}

package.jsonView file

Lines 1-26json

1{

2 "name": "@adep/cli",

3 "version": "0.1.4",

4 "type": "module",

5 "description": "`adep` 命令行工具包位：登录 / 初始化 / 本地调试 / 部署 / 数据库维护 / 云存储 / 静态托管 / 微前端组件（widget），实现见任务单 CLI-001 ~ CLI-003 与 FE-002；子路径 `@adep/cli/vite` 提供云函数 vite 插件（CLI-014）",