@aiscene/aiserver@2.1.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@aiscene/aiserver@2.1.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/.envView file

32patternName = blocked_file severity = critical blockedFile = dist/.env redactedSecretContext = secretLikeLines = 4 L32: OPENAI_API_KEY=<redacted:0 empty> L47: MIDSCENE_MODEL_API_KEY=<redacted:39 token-like> L48: MIDSCENE_MODEL_NAME=<redacted:29 token-like> L49: MIDSCENE_MODEL_FAMILY=<redacted:22 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/task/guada-browser-rpc-client.jsView file

291const result = await record.page.evaluate(async (code) => { L292: const fn = new Function(`return (async () => { ${code} })();`); L293: return await fn();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/task/guada-browser-rpc-client.jsView on unpkg · L291

dist/task/local-code-service.jsView file

1import { execFile } from 'child_process'; L2: import { createHash } from 'crypto'; ... L122: function truncateText(value, maxBytes) { L123: const buffer = Buffer.from(value); L124: if (buffer.byteLength <= maxBytes) ... L718: async gitOutput(rootPath, args, maxBuffer = 1024 * 1024) { L719: const { stdout } = await execFileAsync('git', ['-C', rootPath, ...args], { L720: timeout: 30000, L721: maxBuffer, L722: env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }, L723: }); ... L1025: if (['.java', '.kt', '.cs'].includes(ext)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/task/local-code-service.jsView on unpkg · L1

dist/executor/ios-wda-manager.jsView file

1import { spawn } from 'child_process'; L2: import fs from 'fs'; L3: import net from 'net'; L4: import os from 'os'; ... L53: try { L54: const { stdout } = await execFileText(findExecutable('idevice_id'), ['-l'], 10_000); L55: return stdout ... L118: this.log = options.log || (() => undefined); L119: const logDir = path.join(process.cwd(), 'logs'); L120: fs.mkdirSync(logDir, { recursive: true }); ... L181: }); L182: child.stdin.end();

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

dist/executor/ios-wda-manager.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/executor/ios-wda-manager.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/executor/ios-wda-manager.jsView on unpkg

dist/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/web/server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/server.jsView on unpkg

dist/debug/websocket-server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/debug/websocket-server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/debug/websocket-server.jsView on unpkg

dist/goose-runtime/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/goose-runtime/runtime.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/goose-runtime/runtime.jsView on unpkg

dist/task/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/task/scheduler.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/task/scheduler.jsView on unpkg

dist/scrcpy/server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/scrcpy/server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scrcpy/server.jsView on unpkg

dist/auth/browser-auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aiscene/aiserver@2.0.8 matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.0.8 similarity = 0.787 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth/browser-auth.jsView on unpkg

Source & flagged code

11 flagged

dist/.envView file

Lines 12-49text

12AISERVER_TASK_POLL_INTERVAL=3000

13AISERVER_TASK_API_URL=http://nethp-test.jd.com

14AISERVER_TASK_MAX_CONCURRENT=3

15AISERVER_TASK_TIMEOUT=1200000

16

17# Node

18AISERVER_NODE_PORT=8002

19AISERVER_NODE_TYPE=executor

20AISERVER_NODE_VERSION=1.0.0

21AISERVER_NODE_ENVIRONMENT=prod

22AISERVER_NODE_WEIGHT=1

23AISERVER_NODE_SUPPORTED_TAGS=android,ios,web

24AISERVER_NODE_REGION=

25AISERVER_NODE_DESCRIPTION=

26AISERVER_NODE_REGISTER_URL=http://nethp-test.jd.com/rest/execution-nodes/register

27AISERVER_NODE_HEARTBEAT_URL=http://nethp-test.jd.com/rest/execution-nodes/heartbeat

28AISERVER_NODE_HEARTBEAT_INTERVAL=30000

29

30# AI

31OPENAI_BASE_URL=

32OPENAI_API_KEY=

33MIDSCENE_MODEL_NAME=

34MIDSCENE_USE_QWEN3_VL=1

35

36# Storage

37AISERVER_DB_PATH=./data/aiserver.db

38

39# Callback

40AISERVER_STATUS_UPDATE_URL=http://nethp-test.jd.com/rest/execution-queue/tasks

41AISERVER_REPORT_UPLOAD_URL=http://nethp-test.jd.com/rest/execution-callback/result-file

42AISERVER_DEVICE_HEARTBEAT_URL=http://nethp-test.jd.com/rest/mobile-devices/heartbeat

43AISERVER_DEVICE_STATUS_UPDATE_URL=http://nethp-test.jd.com/rest/mobile-devices

44

45

46MIDSCENE_MODEL_BASE_URL=https://modelservice.jdcloud.com/v1

47MIDSCENE_MODEL_API_KEY=pk-485b2b56-7334-4bed-bd74-09bb42ca3baf

48MIDSCENE_MODEL_NAME=doubao-seed-1-6-vision-250815

49MIDSCENE_MODEL_FAMILY=vlm-ui-tars-doubao-1.5

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg · L32

dist/task/guada-browser-rpc-client.jsView file

Lines 271-311javascript

271 }

272 async click(params) {

273 const record = this.getWindow(params.window_id || params.windowId);

274 if (!params.selector)

dist/task/local-code-service.jsView file

Lines 1-21javascript

1import { execFile } from 'child_process';

2import { createHash } from 'crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/task/local-code-service.jsView on unpkg · L1

3import fs from 'fs/promises';

4

dist/executor/ios-wda-manager.jsView file

Lines 1-21javascript

1import { spawn } from 'child_process';

2import fs from 'fs';

3import net from 'net';

4import os from 'os';

dist/web/server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/web/server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/web/server.jsView on unpkg

dist/debug/websocket-server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/debug/websocket-server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/debug/websocket-server.jsView on unpkg

dist/goose-runtime/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/goose-runtime/runtime.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/goose-runtime/runtime.jsView on unpkg

dist/task/scheduler.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/task/scheduler.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/task/scheduler.jsView on unpkg

dist/scrcpy/server.jsView file

•matchType = normalized_sha256 matchedPackage = @aiscene/aiserver@2.1.0 matchedPath = dist/scrcpy/server.js matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/scrcpy/server.jsView on unpkg

dist/auth/browser-auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aiscene/aiserver@2.0.8 matchedIdentity = npm:QGFpc2NlbmUvYWlzZXJ2ZXI:2.0.8 similarity = 0.787 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/auth/browser-auth.jsView on unpkg