@alumbwe/anvil@1.0.12: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@alumbwe/anvil@1.0.12: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/anvil.cjsView file

8*/ L9: const { spawnSync } = require('child_process') L10: const path = require('path')

High

Child Process

Package source references child process execution.

bin/anvil.cjsView on unpkg · L8

dist/bundled.jsView file

•context = } -ErrorAction Stop } catch {}; ` + `if (Test-Path -LiteralPath ${psQuote(options2.disarmPath)}) { ` + `Remove-Item -LiteralPath ${psQuote(options2.disarmPath)} -Force -ErrorAction SilentlyContinue ` + `} else { ` + `$b=[byte[]](${payloadBytes}); ` + `${writeResets} }; ` + `Remove-Item -LiteralPath ${psQuote(options2.armedPath)} -Force -ErrorAction SilentlyContinue`;\n const powershell = options2.powershellPath ?? path33.join(getCliEnv().SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");\n const watchdogArgs = `-NoProfile -NonInteractive -Command "${watchdogScript}"`;\n const bootstrapScript = `Start-Process -FilePath ${psQuote(powershell)} ` + `-ArgumentList ${psQuote(watchdogArgs)} -NoNewWindow`;\n return spawn6(powershell, ["-NoProfile

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundled.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @alumbwe/anvil@1.0.10 matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.10 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_source_file sizeBytes = 7492208 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_cli_entrypoint sizeBytes = 7492208 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bundled.jsView on unpkg

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

Source & flagged code

7 flagged

bin/anvil.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * npm bin wrapper — launches the bundled CLI via bun.

4 *

5 * npm rejects shebangs other than `node`, so this thin shim exec's bun

6 * with the bundled entry point. When the user has bun installed globally

7 * (`npm i -g bun`) the CLI works out of the box.

8 */

9const { spawnSync } = require('child_process')

10const path = require('path')

High

Child Process

Package source references child process execution.

bin/anvil.cjsView on unpkg · L8

11const fs = require('fs')

12

13const bundledPath = path.join(__dirname, '..', 'dist', 'bundled.js')

14

15if (!fs.existsSync(bundledPath)) {

16 console.error(

17 'Error: bundled CLI not found at ' +

18 bundledPath +

19 '\n' +

20 'Try reinstalling: npm i -g @alumbwe/anvil',

21 )

22 process.exit(1)

23}

24

25// bundled.js targets Bun. Running it with Node produces misleading module

26// loader errors, so fail clearly instead of attempting an unsupported fallback.

27const child = spawnSync('bun', [bundledPath, ...process.argv.slice(2)], {

28 stdio: 'inherit',

dist/bundled.jsView file

•context = } -ErrorAction Stop } catch {}; ` + `if (Test-Path -LiteralPath ${psQuote(options2.disarmPath)}) { ` + `Remove-Item -LiteralPath ${psQuote(options2.disarmPath)} -Force -ErrorAction SilentlyContinue ` + `} else { ` + `$b=[byte[]](${payloadBytes}); ` + `${writeResets} }; ` + `Remove-Item -LiteralPath ${psQuote(options2.armedPath)} -Force -ErrorAction SilentlyContinue`;\n const powershell = options2.powershellPath ?? path33.join(getCliEnv().SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");\n const watchdogArgs = `-NoProfile -NonInteractive -Command "${watchdogScript}"`;\n const bootstrapScript = `Start-Process -FilePath ${psQuote(powershell)} ` + `-ArgumentList ${psQuote(watchdogArgs)} -NoNewWindow`;\n return spawn6(powershell, ["-NoProfile

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundled.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = @alumbwe/anvil@1.0.10 matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.10 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_source_file sizeBytes = 7492208 magicHex = [redacted]

Medium

Oversized Source File

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg