Loading npm security reports…

@alumbwe/anvil@1.0.20: Clean npm security report (Allow) | LPM Firewall

registry / @alumbwe/anvil / 1.0.20

@alumbwe/anvil@1.0.20

A Terminal User Interface (TUI) package built with OpenTUI and React.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 344 file(s), 2.80 MB of source, external domains: aistudio.google.com, codebuff.com, github.com, platform.deepseek.com, registry.npmjs.org, serper.dev, webaim.org, zeroclick.dev

Source & flagged code

8 flagged · loading source

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/utils/terminal-command-broker.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/terminal-command-broker.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

Findings

7 High4 Medium5 Low

HighSemantic Analysis Limitedpackage.json

HighKnown Malware Source Similaritysrc/utils/terminal-command-broker.ts

HighKnown Malware Source Similaritysrc/utils/clipboard.ts

HighKnown Malware Source Similaritysrc/utils/terminal-watchdog.ts

HighKnown Malware Source Similaritysrc/utils/detect-shell.ts

HighKnown Malware Source Similaritysrc/utils/update-checker.ts

HighKnown Malware Source Similaritysrc/utils/windows-terminal-health.ts

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulebin/tree-sitter.wasm

MediumStructural Risk Force Deep Review

LowScripts Present

Low

Affected versions and remediation

This report applies to @alumbwe/anvil@1.0.20.

See all versions of @alumbwe/anvil for other recorded verdicts.

Review the evidence and your use of @alumbwe/anvil@1.0.20 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-14 12:04:11.616Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Source & flagged code

8 flagged

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/utils/terminal-command-broker.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/terminal-command-broker.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/terminal-command-broker.tsView on unpkg

src/utils/clipboard.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/clipboard.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/clipboard.tsView on unpkg

src/utils/terminal-watchdog.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/terminal-watchdog.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/terminal-watchdog.tsView on unpkg

src/utils/detect-shell.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/detect-shell.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/detect-shell.tsView on unpkg

src/utils/update-checker.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/update-checker.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-checker.tsView on unpkg

src/utils/windows-terminal-health.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.36 matchedPath = src/utils/windows-terminal-health.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.36 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/windows-terminal-health.tsView on unpkg