@altimateai/altimate-code@0.9.2: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@altimateai/altimate-code@0.9.2: Suspicious npm security report | LPM Firewall

dbt-tools/dist/index.jsView file

68import { existsSync as existsSync2 } from "fs"; L69: import { execFileSync as execFileSync2 } from "child_process"; L70: import { join as join2 } from "path";

High

Child Process

Package source references child process execution.

dbt-tools/dist/index.jsView on unpkg · L68

24057// src/index.ts L24058: import { join as join8, resolve as resolve4 } from "path"; L24059: import { existsSync as existsSync7 } from "fs"; ... L24065: import { existsSync } from "fs"; L24066: import { execFileSync } from "child_process"; L24067: function configDir() { L24068: return join(process.env.HOME || homedir(), ".altimate-code"); L24069: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dbt-tools/dist/index.jsView on unpkg · L24057

2028var methodName = "on" + name.toLowerCase(); L2029: var method = util.global[methodName]; L2030: if (!method)

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dbt-tools/dist/index.jsView on unpkg · L2028

•matchType = package_source_clone_identity_mismatch matchedPackage = altimate-code@0.9.1 matchedPath = dbt-tools/dist/index.js matchedIdentity = npm:YWx0aW1hdGUtY29kZQ:0.9.1 similarity = 1.000 shingleOverlap = 2 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

dbt-tools/dist/index.jsView on unpkg

917return obj; L918: eval(obj); L919: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dbt-tools/dist/index.jsView on unpkg · L917

68import { existsSync as existsSync2 } from "fs"; L69: import { execFileSync as execFileSync2 } from "child_process"; L70: import { join as join2 } from "path"; ... L73: const out = execFileSync2(cmd, args, { encoding: "utf-8", timeout: 1e4 }); L74: return { ok: true, stdout: out.trim() }; L75: } catch { ... L178: const candidates = []; L179: const envOverride = process.env.ALTIMATE_DBT_PATH; L180: if (envOverride) { ... L296: var init_dbt_resolve = __esm(() => { L297: isWindows2 = process.platform === "win32"; L298: VENV_BIN2 = isWindows2 ? "Scripts" : "bin";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dbt-tools/dist/index.jsView on unpkg · L68

dbt-tools/dist/index.jsView file

68import { existsSync as existsSync2 } from "fs"; L69: import { execFileSync as execFileSync2 } from "child_process"; L70: import { join as join2 } from "path";

High

Child Process

Package source references child process execution.

dbt-tools/dist/index.jsView on unpkg · L68

24057// src/index.ts L24058: import { join as join8, resolve as resolve4 } from "path"; L24059: import { existsSync as existsSync7 } from "fs"; ... L24065: import { existsSync } from "fs"; L24066: import { execFileSync } from "child_process"; L24067: function configDir() { L24068: return join(process.env.HOME || homedir(), ".altimate-code"); L24069: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dbt-tools/dist/index.jsView on unpkg · L24057

2028var methodName = "on" + name.toLowerCase(); L2029: var method = util.global[methodName]; L2030: if (!method)

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dbt-tools/dist/index.jsView on unpkg · L2028

•matchType = package_source_clone_identity_mismatch matchedPackage = altimate-code@0.9.1 matchedPath = dbt-tools/dist/index.js matchedIdentity = npm:YWx0aW1hdGUtY29kZQ:0.9.1 similarity = 1.000 shingleOverlap = 2 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

dbt-tools/dist/index.jsView on unpkg

917return obj; L918: eval(obj); L919: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dbt-tools/dist/index.jsView on unpkg · L917

68import { existsSync as existsSync2 } from "fs"; L69: import { execFileSync as execFileSync2 } from "child_process"; L70: import { join as join2 } from "path"; ... L73: const out = execFileSync2(cmd, args, { encoding: "utf-8", timeout: 1e4 }); L74: return { ok: true, stdout: out.trim() }; L75: } catch { ... L178: const candidates = []; L179: const envOverride = process.env.ALTIMATE_DBT_PATH; L180: if (envOverride) { ... L296: var init_dbt_resolve = __esm(() => { L297: isWindows2 = process.platform === "win32"; L298: VENV_BIN2 = isWindows2 ? "Scripts" : "bin";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dbt-tools/dist/index.jsView on unpkg · L68