@ai-setting/agent-bounty@0.13.4: Suspicious npm security report

Loading npm security reports…

@ai-setting/agent-bounty@0.13.4: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged

dist/bin/bounty.jsView file

Lines 30-94javascript

30 cache.set(mod, to);

31 return to;

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(name, newValue) {

36 this[name] = __returnValue.bind(null, newValue);

37}

38var __export = (target, all) => {

39 for (var name in all)

40 __defProp(target, name, {

41 get: all[name],

42 enumerable: true,

43 configurable: true,

44 set: __exportSetter.bind(all, name)

45 });

46};

47var __require = import.meta.require;

49// ../../node_modules/dotenv/lib/main.js

50var require_main = __commonJS((exports, module) => {

51 var fs = __require("fs");

52 var path = __require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/bounty.jsView on unpkg · L50

53 var os = __require("os");

54 var crypto = __require("crypto");

55 var TIPS = [

56 "\u25C8 encrypted .env [www.dotenvx.com]",

57 "\u25C8 secrets for agents [www.dotenvx.com]",

58 "\u2301 auth for agents [www.vestauth.com]",

59 "\u2318 custom filepath { path: '/custom/path/.env' }",

60 "\u2318 enable debugging { debug: true }",

61 "\u2318 override existing { override: true }",

62 "\u2318 suppress logs { quiet: true }",

63 "\u2318 multiple files { path: ['.env.local', '.env'] }"

64 ];

65 function _getRandomTip() {

66 return TIPS[Math.floor(Math.random() * TIPS.length)];

67 }

68 function parseBoolean(value) {

69 if (typeof value === "string") {

70 return !["false", "0", "no", "off", ""].includes(value.toLowerCase());

71 }

72 return Boolean(value);

73 }

74 function supportsAnsi() {

75 return process.stdout.isTTY;

76 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/bounty.jsView on unpkg · L74

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/bounty.jsView on unpkg · L74

77 function dim(text) {

78 return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;

79 }

80 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|

81 function parse(src) {

82 const obj = {};

83 let lines = src.toString();

84 lines = lines.replace(/\r\n?/mg, `

85`);

86 let match;

87 while ((match = LINE.exec(lines)) != null) {

88 const key = match[1];

89 let value = match[2] || "";

90 value = value.trim();

91 const maybeQuote = value[0];

92 value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");

93 if (maybeQuote === '"') {

94 value = value.replace(/\\n/g, `

Lines 11158-11198javascript

11158 }

11159 if (!agentColumnNames.includes("address")) {

11160 this.db.run(`ALTER TABLE agents ADD COLUMN address TEXT`);

11161 }

11162 this.db.run(`

11163

•matchType = previous_version_dangerous_delta matchedPackage = @ai-setting/agent-bounty@0.10.0 matchedIdentity = npm:[redacted]:0.10.0 similarity = 0.670 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/bounty.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/bin/bounty.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/bounty.jsView on unpkg

11178} L11179: exec(sql) { L11180: this.db.exec(sql);

High

Child Process

Package source references child process execution.

dist/bin/bounty.jsView on unpkg · L11178

74Cross-file remote execution chain: dist/bin/bounty.js spawns dist/server/server.js; helper contains network access plus dynamic code execution. L74: function supportsAnsi() { L75: return process.stdout.isTTY; L76: } ... L107: if (!result.parsed) { L108: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L109: err.code = "MISSING_DATA"; ... L141: } L142: if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) { L143: return process.env.DOTENV_KEY; ... L192: } else { L193: possibleVaultPath = path.resolve(process.cwd(), ".env.vault"); L194: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/bounty.jsView on unpkg · L74

50var require_main = __commonJS((exports, module) => { L51: var fs = __require("fs"); L52: var path = __require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/bounty.jsView on unpkg · L50

74function supportsAnsi() { L75: return process.stdout.isTTY; L76: } ... L107: if (!result.parsed) { L108: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L109: err.code = "MISSING_DATA"; ... L141: } L142: if (process.env.DOTENV_KEY && process.env.DOTENV_KEY.length > 0) { L143: return process.env.DOTENV_KEY; ... L192: } else { L193: possibleVaultPath = path.resolve(process.cwd(), ".env.vault"); L194: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/bounty.jsView on unpkg · L74

Source & flagged code

5 flagged

dist/bin/bounty.jsView file

Lines 30-94javascript

30 cache.set(mod, to);

31 return to;

32};

33var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);

34var __returnValue = (v) => v;

35function __exportSetter(name, newValue) {

36 this[name] = __returnValue.bind(null, newValue);

37}

38var __export = (target, all) => {

39 for (var name in all)

40 __defProp(target, name, {

41 get: all[name],

42 enumerable: true,

43 configurable: true,

44 set: __exportSetter.bind(all, name)

45 });

46};

47var __require = import.meta.require;

49// ../../node_modules/dotenv/lib/main.js

50var require_main = __commonJS((exports, module) => {

51 var fs = __require("fs");

52 var path = __require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/bounty.jsView on unpkg · L50

53 var os = __require("os");

54 var crypto = __require("crypto");

55 var TIPS = [

56 "\u25C8 encrypted .env [www.dotenvx.com]",

57 "\u25C8 secrets for agents [www.dotenvx.com]",

58 "\u2301 auth for agents [www.vestauth.com]",

59 "\u2318 custom filepath { path: '/custom/path/.env' }",

60 "\u2318 enable debugging { debug: true }",

61 "\u2318 override existing { override: true }",

62 "\u2318 suppress logs { quiet: true }",

63 "\u2318 multiple files { path: ['.env.local', '.env'] }"

64 ];

65 function _getRandomTip() {

66 return TIPS[Math.floor(Math.random() * TIPS.length)];

67 }

68 function parseBoolean(value) {

69 if (typeof value === "string") {

70 return !["false", "0", "no", "off", ""].includes(value.toLowerCase());

71 }

72 return Boolean(value);

73 }

74 function supportsAnsi() {

75 return process.stdout.isTTY;

76 }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/bin/bounty.jsView on unpkg · L74

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/bounty.jsView on unpkg · L74

77 function dim(text) {

78 return supportsAnsi() ? `\x1B[2m${text}\x1B[0m` : text;

79 }

80 var LINE = /(?:^|^)\s*(?:export\s+)?([\w.-]+)(?:\s*=\s*?|:\s+?)(\s*'(?:\\'|[^'])*'|\s*"(?:\\"|

81 function parse(src) {

82 const obj = {};

83 let lines = src.toString();

84 lines = lines.replace(/\r\n?/mg, `

85`);

86 let match;

87 while ((match = LINE.exec(lines)) != null) {

88 const key = match[1];

89 let value = match[2] || "";

90 value = value.trim();

91 const maybeQuote = value[0];

92 value = value.replace(/^(['"`])([\s\S]*)\1$/mg, "$2");

93 if (maybeQuote === '"') {

94 value = value.replace(/\\n/g, `

Lines 11158-11198javascript

11158 }

11159 if (!agentColumnNames.includes("address")) {

11160 this.db.run(`ALTER TABLE agents ADD COLUMN address TEXT`);

11161 }

11162 this.db.run(`

11163

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/bounty.jsView on unpkg

@ai-setting/agent-bounty@0.13.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code