@aladas-org/cryptocalc@0.5.29: Malicious npm security report | LPM Firewall

Loading npm security reports…

@aladas-org/cryptocalc@0.5.29: Malicious npm security report | LPM Firewall

Source & flagged code

14 flagged · loading source

www/js/crypto/password_strength_evaluator.jsView file

449patternName = generic_password severity = medium line = 449 matchedText = let pass...le';

Medium

Secret Pattern

Package contains a possible secret pattern.

www/js/crypto/password_strength_evaluator.jsView on unpkg · L449

452patternName = generic_password severity = medium line = 452 matchedText = password...er';

Medium

Secret Pattern

Hardcoded password in www/js/crypto/password_strength_evaluator.js

www/js/crypto/password_strength_evaluator.jsView on unpkg · L452

455patternName = generic_password severity = medium line = 455 matchedText = password...st';

Medium

Secret Pattern

Hardcoded password in www/js/crypto/password_strength_evaluator.js

www/js/crypto/password_strength_evaluator.jsView on unpkg · L455

_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.jsView file

112`)}function TE(n){const e=[{regex:/\b[\d,.]+[bkmBKM]+\b/,replacement:"[\\d,.]+[bkmBKM]+"},{regex:/\b\d+[hmsp]+\b/,replacement:"\\d+[hmsp]+"},{regex:/\b[\d,.]+[hmsp]+\b/,replacement... L113: ${n.stack}`,{e:{n:n.name,m:n.message,s:u}}}if(OA(n))return{d:n.toJSON()};if(jA(n))return{u:n.toJSON()};if(MA(n))return{r:{p:n.source,f:n.flags}};for(const[u,f]of Object.entries(Uv)... L114: (() => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

_archives/tests-prev/playwright/playwright-report/trace/assets/defaultSettingsView-CJSZINFr.jsView on unpkg · L112

_archives/tests-prev/unit/core/constants.test.jsView file

3L4: const { BITCOIN, ETHEREUM } = require('../../../www/js/crypto/const_blockchains.js'); L5: const { PRIVATE_KEY, ADDRESS } = require('../../../www/js/crypto/const_wallet.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

_archives/tests-prev/unit/core/constants.test.jsView on unpkg · L3

www/js/view/_archives/main_gui.jsView file

3// ===================================================================================================================== L4: // https://www.electronjs.org/docs/latest/tutorial/quick-start L5: ... L42: // * updateWIF( blockchain, wif ) L43: // * updatePrivateKey( blockchain, PRIV_KEY ) L44: // * async updateChecksum( entropy ) ... L465: // ---------- Private Key ---------- L466: let private_key = json_data[PRIVATE_KEY]; L467: this.wallet_info.setAttribute( PRIVATE_KEY, private_key ); ... L1394: if ( options_data == undefined ) { L1395: trace2Main(" " + _RED_ + "**ERROR** options_data: " + options_data + _END_); L1396: await window.ipcMain.QuitApp();

Critical

Clipboard Crypto Hijack

Source reads and rewrites clipboard contents matching cryptocurrency wallet addresses.

www/js/view/_archives/main_gui.jsView on unpkg · L3

_archives/tests-prev/_open_cmd_window.batView file

•path = _archives/tests-prev/_open_cmd_window.bat kind = build_helper sizeBytes = 13 magicHex = 737461727420636d642e657865

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

_archives/tests-prev/_open_cmd_window.batView on unpkg

_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zipView file

•path = _archives/tests-prev/playwright/playwright-[redacted].zip kind = high_entropy_blob sizeBytes = 5025 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zipView on unpkg

•path = _archives/tests-prev/playwright/playwright-[redacted].zip kind = compressed_blob sizeBytes = 5025 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

_archives/tests-prev/playwright/playwright-report/data/1680a02ff3da9343a6b0d57113ea1a4e8378cafd.zipView on unpkg

•path = _archives/tests-prev/playwright/playwright-[redacted].zip kind = nested_archive_needs_inspection sizeBytes = 5025 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

tests/_run_tests.pyView file

•path = tests/_run_tests.py kind = payload_in_excluded_dir sizeBytes = 6295 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/_run_tests.pyView on unpkg

www/js/_main/db/previous/sqlite_utils_Not_Synchronous.jsView file

204patternName = generic_password severity = medium line = 204 matchedText = const ha...Fi';

Medium

Secret Pattern

Hardcoded password in www/js/_main/db/previous/sqlite_utils_Not_Synchronous.js

www/js/_main/db/previous/sqlite_utils_Not_Synchronous.jsView on unpkg · L204

www/js/_main/db/previous/sqlite_utils previous.jsView file

199patternName = generic_password severity = medium line = 199 matchedText = const ha...Fi';

Medium

Secret Pattern

Hardcoded password in www/js/_main/db/previous/sqlite_utils previous.js

www/js/_main/db/previous/sqlite_utils previous.jsView on unpkg · L199

www/js/_main/db/sqlite_utils.jsView file

343patternName = generic_password severity = medium line = 343 matchedText = const ha...Fi';

Medium

Secret Pattern

Hardcoded password in www/js/_main/db/sqlite_utils.js

www/js/_main/db/sqlite_utils.jsView on unpkg · L343