@arcforge/axon@2.0.23: Suspicious npm security report (Warn)

Loading npm security reports…

@arcforge/axon@2.0.23: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

capsule-process.jsView file

Lines 1-8javascript

1#!/usr/bin/env bun

2// @bun

3import{AsyncLocalStorage as ZJ}from"async_hooks";var f=["log","info","warn","error","debug"];function v(J){let{wire:G}=J,$=new ZJ,z={log:console.log.bind(console),info:console.info.bind(console),warn:console.warn.bind(console),error:console.error.bind(console),debug:console.debug.bind(console)};for(let N of f)console[N]=(...H)=>{let X=$.getStore()??null;G.emit("capsule:console",{level:N,commandId:X,args:H})};return{run(N,H){return $.run(N,H)},write(N,H){let X=$.getStore()??null,Y=typeof H==="string"?H:new TextDecoder().decode(H);return G.emit("capsule:console",{level:N,commandId:X,args:[Y]}),! ...

4`),matches:[],totalLines:H,matchedLines:X.length};function _(Z){if(Q&&Q.test(Z))return!1;if(Y&&!Y.test(Z))return!1;if(F&&!F.test(Z))return!1;return!0}let K=z.context??0,T=[],B=new Set;for(let Z=0;Z<X.length;Z++){let P=X[Z];if(P===void 0||!_(P))continue;B.add(Z),T.push({line:Z,text:P,before:K>0?X.slice(Math.max(0,Z-K),Z):[],after:K>0?X.slice(Z+1,Math.min(X.length,Z+1+K)):[]})}let D=X.filter((Z,P)=>B.has(P));return{procId:J,stream:$,lines:D,raw:D.join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capsule-process.jsView on unpkg · L2

5`),matches:T,totalLines:H,matchedLines:D.length}}function i(J){if(J instanceof RegExp)return($)=>J.test($);let G=J.toLowerCase();return($)=>$.toLowerCase().includes(G)}function PJ(J,G){if(!J)return"";let $=[],z=0;for(let N=0;N<J.length;N++)if(J[N]===`

6`)$.push(J.slice(z,N+1)),z=N+1;if(z<J.length)$.push(J.slice(z));return $.slice(-G).join("")}function s(J,G){let $=new Promise((H)=>{if(J.status==="exited"){H({exitCode:J.exitCode??-1,ok:J.exitCode===0,stdout:J.stdout.join("")});return}let X=G.subscribe(J.procId+":exit",()=>{X(),H({exitCode:J.exitCode??-1,ok:J.exitCode===0,stdout:J.stdout.join("")})})});function z(H=["stdout"]){let X=[];if(H.includes("stdout"))X.push(J.stdout.join(""));if(H.includes("stderr"))X.push(J.stderr.join(""));return X.join("")}let N={get procId(){return J.procId},get kind(){return J.kind},get command(){return J.command ...

7`)},onCommand(z){return J.add(z),()=>J.delete(z)}}}var r=process.exit.bind(process);function t(J){let G=process;if(

8

Long lines were clipped for display.

update-helper.jsView file

Lines 1-12javascript

1// @bun

2import{mkdir as l,rename as f,writeFile as w}from"fs/promises";import{dirname as b}from"path";async function x(t,e

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 22844165 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

•path = index.js kind = oversized_cli_entrypoint sizeBytes = 22844165 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

index.jsView on unpkg

Source & flagged code

5 flagged · loading source

capsule-process.jsView file

2// @bun L3: import{AsyncLocalStorage as ZJ}from"async_hooks";var f=["log","info","warn","error","debug"];function v(J){let{wire:G}=J,$=new ZJ,z={log:console.log.bind(console),info:console.info... L4: `),matches:[],totalLines:H,matchedLines:X.length};function _(Z){if(Q&&Q.test(Z))return!1;if(Y&&!Y.test(Z))return!1;if(F&&!F.test(Z))return!1;return!0}let K=z.context??0,T=[],B=new ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capsule-process.jsView on unpkg · L2

update-helper.jsView file

1// @bun L2: import{mkdir as l,rename as f,writeFile as w}from"fs/promises";import{dirname as b}from"path";async function x(t,e={}){let o=e.run??y;if(await(e.wait??g)(t.parent),await d(t.state,... L3: Updating Axon ${t.from} \u2192 ${t.to}\u2026 ... L6: `),0}process.stderr.write(`Axon update failed verification; restoring the previous version\u2026 L7: `);let i=await o([t.bun,"add","-g",`@arcforge/axon@${t.from}`]),s=i.code===0?`update to ${t.to} failed verification; restored ${t.from}`:`update to ${t.to} failed and rollback to $... L8: L9: `),1}function A(t){let e=new Map;for(let r=0;r<t.length;r+=2){let u=t[r],p=t[r+1];if(!u?.startsWith("--")||p===void 0)throw Error("UPDATE_HELPER_ARGS_INVALID");e.set(u.slice(2),p)}... L10: `,"utf-8"),await f(o,t)}function m(t){return/^\d+\.\d+\.\d+(

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

update-helper.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @arcforge/axon@2.0.21 matchedIdentity = npm:QGFyY2ZvcmdlL2F4b24:2.0.21 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

update-helper.jsView on unpkg

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 22844165 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

•path = index.js kind = oversized_cli_entrypoint sizeBytes = 22844165 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

index.jsView on unpkg

@arcforge/axon@2.0.23

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code