@alumbwe/anvil@1.0.6: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@alumbwe/anvil@1.0.6: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

bin/anvil.cjsView file

8*/ L9: const { execFileSync, spawnSync } = require('child_process'); L10: const path = require('path');

High

Child Process

Package source references child process execution.

bin/anvil.cjsView on unpkg · L8

8Cross-file remote execution chain: bin/anvil.cjs spawns dist/bundled.js; helper contains network access plus dynamic code execution. L8: */ L9: const { execFileSync, spawnSync } = require('child_process'); L10: const path = require('path'); ... L12: L13: const bundledPath = path.join(__dirname, '..', 'dist', 'bundled.js'); L14: ... L37: 'Error: neither bun nor node found on PATH.\n' + L38: 'Install bun: https://bun.sh', L39: );

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/anvil.cjsView on unpkg · L8

dist/bundled.jsView file

•context = } -ErrorAction Stop } catch {}; ` + `if (Test-Path -LiteralPath ${psQuote(options2.disarmPath)}) { ` + `Remove-Item -LiteralPath ${psQuote(options2.disarmPath)} -Force -ErrorAction SilentlyContinue ` + `} else { ` + `$b=[byte[]](${payloadBytes}); ` + `${writeResets} }; ` + `Remove-Item -LiteralPath ${psQuote(options2.armedPath)} -Force -ErrorAction SilentlyContinue`;\n const powershell = options2.powershellPath ?? path33.join(getCliEnv().SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");\n const watchdogArgs = `-NoProfile -NonInteractive -Command "${watchdogScript}"`;\n const bootstrapScript = `Start-Process -FilePath ${psQuote(powershell)} ` + `-ArgumentList ${psQuote(watchdogArgs)} -NoNewWindow`;\n return spawn6(powershell, ["-NoProfile

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_source_file sizeBytes = 7705318 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_cli_entrypoint sizeBytes = 7705318 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bundled.jsView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg

Source & flagged code

6 flagged

bin/anvil.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2/**

3 * npm bin wrapper — launches the bundled CLI via bun.

4 *

5 * npm rejects shebangs other than `node`, so this thin shim exec's bun

6 * with the bundled entry point. When the user has bun installed globally

7 * (`npm i -g bun`) the CLI works out of the box.

8 */

9const { execFileSync, spawnSync } = require('child_process');

10const path = require('path');

High

Child Process

Package source references child process execution.

bin/anvil.cjsView on unpkg · L8

11const fs = require('fs');

12

13const bundledPath = path.join(__dirname, '..', 'dist', 'bundled.js');

14

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/anvil.cjsView on unpkg · L8

15if (!fs.existsSync(bundledPath)) {

16 console.error(

17 'Error: bundled CLI not found at ' + bundledPath + '\n' +

18 'Try reinstalling: npm i -g @alumbwe/anvil',

19 );

20 process.exit(1);

21}

22

23// Try bun first (preferred), then fall back to node.

24function tryRun(cmd, args) {

25 try {

26 const child = spawnSync(cmd, args, { stdio: 'inherit' });

27 if (child.error && child.error.code === 'ENOENT') return false;

28 process.exit(child.status ?? 1);

dist/bundled.jsView file

•context = } -ErrorAction Stop } catch {}; ` + `if (Test-Path -LiteralPath ${psQuote(options2.disarmPath)}) { ` + `Remove-Item -LiteralPath ${psQuote(options2.disarmPath)} -Force -ErrorAction SilentlyContinue ` + `} else { ` + `$b=[byte[]](${payloadBytes}); ` + `${writeResets} }; ` + `Remove-Item -LiteralPath ${psQuote(options2.armedPath)} -Force -ErrorAction SilentlyContinue`;\n const powershell = options2.powershellPath ?? path33.join(getCliEnv().SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");\n const watchdogArgs = `-NoProfile -NonInteractive -Command "${watchdogScript}"`;\n const bootstrapScript = `Start-Process -FilePath ${psQuote(powershell)} ` + `-ArgumentList ${psQuote(watchdogArgs)} -NoNewWindow`;\n return spawn6(powershell, ["-NoProfile

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_source_file sizeBytes = 7705318 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundled.jsView on unpkg

•path = dist/bundled.js kind = oversized_cli_entrypoint sizeBytes = 7705318 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bundled.jsView on unpkg

bin/tree-sitter.wasmView file

•path = bin/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bin/tree-sitter.wasmView on unpkg