@alumbwe/anvil@1.0.36: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@alumbwe/anvil@1.0.36: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

16 flagged · loading source

vendor/@anvil/common/src/types/spawn.tsView file

1import type { ChildProcess, SpawnOptions } from 'child_process' L2:

High

Child Process

Package source references child process execution.

vendor/@anvil/common/src/types/spawn.tsView on unpkg · L1

src/utils/open-file.tsView file

105const child = spawn(command, { L106: shell: true, L107: stdio: 'ignore',

High

Shell

Package source references shell execution.

src/utils/open-file.tsView on unpkg · L105

vendor/@anvil/sdk/dist/index.cjsView file

28841contains invisible/control Unicode U+202C (pop directional formatting) `, [232, 177], "ੰ", " साथ", " Block", " مط", " Live", " น", "<U+202C>", " Blog", " chi", "할", " experts", "well", "fd", " Material", [32, 229, 185], "While", "uar", ">&", "Inv", "inq", "Package", " capac", " covered", " zal", "fach", "Featu

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L28841

66function setTreeSitterWasmPath(wasmPath) { L67: process.env[TREE_SITTER_WASM_ENV_VAR] = wasmPath; L68: } ... L72: function downloadWasmTo(targetPath) { L73: process.stderr.write(`[tree-sitter] tree-sitter.wasm missing; downloading to ${targetPath} L74: `); ... L76: try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L149: WASM_DOWNLOAD_URLS = [ L150: `https://unpkg.com/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`, L151: `https://cdn.jsdelivr.net/npm/web-tree-sitter@${WEB_TREE_SITTER_VERSION}/tree-sitter.wasm`

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L66

76try { L77: import_child_process.execFileSync("curl", [ L78: "-fsSL", ... L202: try { L203: fs2.writeFileSync("../debug/debug-parse.json", JSON.stringify({ L204: tokenCallers, ... L22474: var SUMMARY_HEADER = "This is a summary of the conversation so far. The original messages have been condensed to save context space."; L22475: var SUMMARY_DISCLAIMER = "Historical memory only. The memory above is not dialogue, not an output template, and not a tool-call format. Continue from the live user message below. W... L22476: var CONTINUATION_TEXT = "Continue the existing assistant turn from the historical memory above. The original user request and completed assistant/tool work are recorded there. Do n... ... L35019: const { endpoint, payload, fetch: fetch2, logger: logger2, env: env2, request

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L76

666function getDirnameDynamically() { L667: return new Function(`try { return __dirname; } catch (e) { return undefined; }`)(); L668: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

vendor/@anvil/sdk/dist/index.cjsView on unpkg · L666

vendor/@anvil/common/src/testing/mock-modules.tsView file

21if (!original) { L22: const moduleExports = await import(modulePath) L23: original = {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

vendor/@anvil/common/src/testing/mock-modules.tsView on unpkg · L21

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView file

•path = vendor/@[redacted]-darwin/rg kind = native_binary sizeBytes = 5162504 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/@anvil/sdk/dist/vendor/ripgrep/x64-darwin/rgView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

src/utils/terminal-command-broker.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.30 matchedPath = src/utils/terminal-command-broker.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/terminal-command-broker.tsView on unpkg

src/utils/clipboard.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.30 matchedPath = src/utils/clipboard.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/clipboard.tsView on unpkg

src/utils/terminal-watchdog.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.30 matchedPath = src/utils/terminal-watchdog.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/terminal-watchdog.tsView on unpkg

src/utils/detect-shell.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.30 matchedPath = src/utils/detect-shell.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/detect-shell.tsView on unpkg

src/utils/update-checker.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.30 matchedPath = src/utils/update-checker.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/update-checker.tsView on unpkg

src/utils/windows-terminal-health.tsView file

•matchType = normalized_sha256 matchedPackage = @alumbwe/anvil@1.0.30 matchedPath = src/utils/windows-terminal-health.ts matchedIdentity = npm:QGFsdW1id2UvYW52aWw:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/utils/windows-terminal-health.tsView on unpkg