@alienplatform/sdk@1.14.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@alienplatform/sdk@1.14.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/esm.jsView file

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/esm.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/esm.js L6: import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/esm.jsView on unpkg · L6

9import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto";

High

Child Process

Package source references child process execution.

dist/esm.jsView on unpkg · L9

16917//#endregion L16918: //#region ../../node_modules/.pnpm/@azure+identity@4.13.1/node_modules/@[redacted].js L16919: const logger$9 = credentialLogger("AzurePowerShellCredential");

High

Shell

Package source references shell execution.

dist/esm.jsView on unpkg · L16917

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/esm.jsView on unpkg · L6

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm.jsView on unpkg · L6

6Cross-file remote execution chain: dist/esm.js spawns dist/dist2.js; helper contains network access plus dynamic code execution. L6: import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/esm.jsView on unpkg · L6

881patternName = generic_password severity = medium line = 881 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm.jsView on unpkg · L881

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm.jsView on unpkg · L6

scripts/generate-proto.shView file

•path = scripts/generate-proto.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-proto.shView on unpkg

dist/src2.jsView file

•path = dist/src2.js kind = oversized_source_file sizeBytes = 3976537 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src2.jsView on unpkg

Source & flagged code

11 flagged

dist/esm.jsView file

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/esm.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/esm.js L6: import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/esm.jsView on unpkg · L6

9import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto";

High

Child Process

Package source references child process execution.

dist/esm.jsView on unpkg · L9

16917//#endregion L16918: //#region ../../node_modules/.pnpm/@azure+identity@4.13.1/node_modules/@[redacted].js L16919: const logger$9 = credentialLogger("AzurePowerShellCredential");

High

Shell

Package source references shell execution.

dist/esm.jsView on unpkg · L16917

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/esm.jsView on unpkg · L6

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm.jsView on unpkg · L6

6Cross-file remote execution chain: dist/esm.js spawns dist/dist2.js; helper contains network access plus dynamic code execution. L6: import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/esm.jsView on unpkg · L6

881patternName = generic_password severity = medium line = 881 matchedText = passwo...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/esm.jsView on unpkg · L881

6import path from "path"; L7: import http from "http"; L8: import { createHash, createPrivateKey, randomUUID } from "node:crypto"; L9: import { readFile } from "node:fs/promises"; L10: import childProcess from "node:child_process"; L11: import crypto, { createHash as createHash$1 } from "crypto"; ... L280: else if (typeof errorBody === "string") try { L281: errorResponse = [redacted](JSON.parse(errorBody)); L282: } catch (e) { ... L288: error: "unknown_error", L289: errorDescription: `An unknown error has occurred. Response body:\n\n${errorBody}` L290: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm.jsView on unpkg · L6

scripts/generate-proto.shView file

•path = scripts/generate-proto.sh kind = build_helper sizeBytes = 1338 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/generate-proto.shView on unpkg

dist/src2.jsView file

•path = dist/src2.js kind = oversized_source_file sizeBytes = 3976537 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/src2.jsView on unpkg