@alumbwe/anvil@1.0.28: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@alumbwe/anvil@1.0.28: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

vendor/@anvil/common/src/types/spawn.tsView file

1import type { ChildProcess, SpawnOptions } from 'child_process' L2:

High

Child Process

Package source references child process execution.

vendor/@anvil/common/src/types/spawn.tsView on unpkg · L1

src/utils/open-file.tsView file

105const child = spawn(command, { L106: shell: true, L107: stdio: 'ignore',

High

Shell

Package source references shell execution.

src/utils/open-file.tsView on unpkg · L105

vendor/@anvil/sdk/dist/index.cjsView file

28841contains invisible/control Unicode U+202C (pop directional formatting) `, [232, 177], "ੰ", " साथ", " Block", " مط", " Live", " น", "<U+202C>", " Blog", " chi", "할", " experts", "well", "fd", " Material", [32, 229, 185], "While", "uar", ">&", "Inv", "inq", "Package", " capac", " covered", " zal", "fach", "Featu

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L28841

66function setTreeSitterWasmPath(wasmPath) { L67: process.env[TREE_SITTER_WASM_ENV_VAR] = wasmPath; L68: } ... L72: function downloadWasmTo(targetPath) { L73: process.stderr.write(`[tree-sitter] tree-sitter.wasm missing; downloading to ${targetPath} L74: `); ... L76: try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L149: WASM_DOWNLOAD_URLS = [ L150: `https://unpkg.com/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`, L151: `https://cdn.jsdelivr.net/npm/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L66

76try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L202: try { L203: fs2.writeFileSync("../debug/debug-parse.json", JSON.stringify({ L204: tokenCallers, ... L22474: var SUMMARY_HEADER = "This is a summary of the conversation so far. The original messages have been condensed to save context space."; L22475: var SUMMARY_DISCLAIMER = "Historical memory only. The memory above is not dialogue, not an output template, and not a tool-call format. Continue from the live user message below. W... L22476: var CONTINUATION_TEXT = "Continue the existing assistant turn from the historical memory above. The original user request and completed assistant/tool work are recorded there. Do n... ... L35019: const { endpoint, payload, fetch: fetch2, logger: logger2, env: env2, request

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L76

666function getDirnameDynamically() { L667: return new Function(`try { return __dirname; } catch (e) { return undefined; }`)(); L668: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L666

vendor/@anvil/common/src/testing/mock-modules.tsView file

21if (!original) { L22: const moduleExports = await import(modulePath) L23: original = {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/@anvil/common/src/testing/mock-modules.tsView on unpkg · L21

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView file

•path = vendor/@[redacted]-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

10 flagged

vendor/@anvil/common/src/types/spawn.tsView file

Lines 1-14typescript

1import type { ChildProcess, SpawnOptions } from 'child_process'

2

High

Child Process

Package source references child process execution.

vendor/@anvil/common/src/types/spawn.tsView on unpkg · L1

3/**

4 * Spawn function for running shell commands.

5 *

6 * Compatible with `child_process.spawn` from Node.js.

7 * Returns ChildProcess to support full streaming capabilities (stdin, stdout, stderr).

8 */

9export type AnvilSpawn = (

10 command: string,

11 args?: readonly string[],

12 options?: SpawnOptions,

13) => ChildProcess

14

src/utils/open-file.tsView file

Lines 85-125typescript

85

86 for (const candidate of candidates) {

87 if (candidate.detect) {

88 commands.push(candidate.command)

89 }

90 }

91

92

vendor/@anvil/sdk/dist/index.cjsView file

28841contains invisible/control Unicode U+202C (pop directional formatting) `, [232, 177], "ੰ", " साथ", " Block", " مط", " Live", " น", "<U+202C>", " Blog", " chi", "할", " experts", "well", "fd", " Material", [32, 229, 185], "While", "uar", ">&", "Inv", "inq", "Package", " capac", " covered", " zal", "fach", "Featu

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L28841

66function setTreeSitterWasmPath(wasmPath) { L67: process.env[TREE_SITTER_WASM_ENV_VAR] = wasmPath; L68: } ... L72: function downloadWasmTo(targetPath) { L73: process.stderr.write(`[tree-sitter] tree-sitter.wasm missing; downloading to ${targetPath} L74: `); ... L76: try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L149: WASM_DOWNLOAD_URLS = [ L150: `https://unpkg.com/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`, L151: `https://cdn.jsdelivr.net/npm/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L66

76try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L202: try { L203: fs2.writeFileSync("../debug/debug-parse.json", JSON.stringify({ L204: tokenCallers, ... L22474: var SUMMARY_HEADER = "This is a summary of the conversation so far. The original messages have been condensed to save context space."; L22475: var SUMMARY_DISCLAIMER = "Historical memory only. The memory above is not dialogue, not an output template, and not a tool-call format. Continue from the live user message below. W... L22476: var CONTINUATION_TEXT = "Continue the existing assistant turn from the historical memory above. The original user request and completed assistant/tool work are recorded there. Do n... ... L35019: const { endpoint, payload, fetch: fetch2, logger: logger2, env: env2, request

vendor/@anvil/common/src/testing/mock-modules.tsView file

Lines 1-41typescript

1import { mock } from 'bun:test'

2

3export type MockResult = {

4 clear: () => void

5}

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView file

•path = vendor/@[redacted]-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg