@arcforge/axon@2.0.26: Suspicious npm security report (Warn)

Loading npm security reports…

@arcforge/axon@2.0.26: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

capsule-process.jsView file

Lines 1-8javascript

1#!/usr/bin/env bun

2// @bun

3import{AsyncLocalStorage as ZJ}from"async_hooks";var f=["log","info","warn","error","debug"];function v(J){let{wire:G}=J,$=new ZJ,z={log:console.log.bind(console),info:console.info.bind(console),warn:console.warn.bind(console),error:console.error.bind(console),debug:console.debug.bind(console)};for(let N of f)console[N]=(...H)=>{let X=$.getStore()??null;G.emit("capsule:console",{level:N,commandId:X,args:H})};return{run(N,H){return $.run(N,H)},write(N,H){let X=$.getStore()??null,Y=typeof H==="string"?H:new TextDecoder().decode(H);return G.emit("capsule:console",{level:N,commandId:X,args:[Y]}),! ...

4`),matches:[],totalLines:H,matchedLines:X.length};function _(Z){if(Q&&Q.test(Z))return!1;if(Y&&!Y.test(Z))return!1;if(F&&!F.test(Z))return!1;return!0}let K=z.context??0,T=[],B=new Set;for(let Z=0;Z<X.length;Z++){let P=X[Z];if(P===void 0||!_(P))continue;B.add(Z),T.push({line:Z,text:P,before:K>0?X.slice(Math.max(0,Z-K),Z):[],after:K>0?X.slice(Z+1,Math.min(X.length,Z+1+K)):[]})}let D=X.filter((Z,P)=>B.has(P));return{procId:J,stream:$,lines:D,raw:D.join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capsule-process.jsView on unpkg · L2

5`),matches:T,totalLines:H,matchedLines:D.length}}function i(J){if(J instanceof RegExp)return($)=>J.test($);let G=J.toLowerCase();return($)=>$.toLowerCase().includes(G)}function PJ(J,G){if(!J)return"";let $=[],z=0;for(let N=0;N<J.length;N++)if(J[N]===`

6`)$.push(J.slice(z,N+1)),z=N+1;if(z<J.length)$.push(J.slice(z));return $.slice(-G).join("")}function s(J,G){let $=new Promise((H)=>{if(J.status==="exited"){H({exitCode:J.exitCode??-1,ok:J.exitCode===0,stdout:J.stdout.join("")});return}let X=G.subscribe(J.procId+":exit",()=>{X(),H({exitCode:J.exitCode??-1,ok:J.exitCode===0,stdout:J.stdout.join("")})})});function z(H=["stdout"]){let X=[];if(H.includes("stdout"))X.push(J.stdout.join(""));if(H.includes("stderr"))X.push(J.stderr.join(""));return X.join("")}let N={get procId(){return J.procId},get kind(){return J.kind},get command(){return J.command ...

7`)},onCommand(z){return J.add(z),()=>J.delete(z)}}}var r=process.exit.bind(process);function t(J){let G=process;if(

8

Long lines were clipped for display.

update-helper.jsView file

Lines 1-13javascript

1// @bun

2import{mkdir as f,rename as w,writeFile as b}from"fs/promises";import{dirname as A}from"path";var l=4;async function

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 22844295 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

•path = index.js kind = oversized_cli_entrypoint sizeBytes = 22844295 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

index.jsView on unpkg

Source & flagged code

5 flagged · loading source

capsule-process.jsView file

2// @bun L3: import{AsyncLocalStorage as ZJ}from"async_hooks";var f=["log","info","warn","error","debug"];function v(J){let{wire:G}=J,$=new ZJ,z={log:console.log.bind(console),info:console.info... L4: `),matches:[],totalLines:H,matchedLines:X.length};function _(Z){if(Q&&Q.test(Z))return!1;if(Y&&!Y.test(Z))return!1;if(F&&!F.test(Z))return!1;return!0}let K=z.context??0,T=[],B=new ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capsule-process.jsView on unpkg · L2

update-helper.jsView file

1// @bun L2: import{mkdir as f,rename as w,writeFile as b}from"fs/promises";import{dirname as A}from"path";var l=4;async function x(t,e={}){let o=e.run??$,n=e.wait??y,a=e.sleep??Bun.sleep;await... L3: Updating Axon ${t.from} \u2192 ${t.to}\u2026 ... L7: `),0}process.stderr.write(`Axon update failed verification; restoring the previous version\u2026 L8: `);let c=await o([t.bun,"add","-g",`@arcforge/axon@${t.from}`]),d=c.code===0?`update to ${t.to} failed verification; restored ${t.from}`:`update to ${t.to} failed and rollback to $... L9: L10: `),1}function v(t){let e=new Map;for(let s=0;s<t.length;s+=2){let r=t[s],u=t[s+1];if(!r?.startsWith("--")||u===void 0)throw Error("UPDATE_HELPER_ARGS_INVALID");e.set(r.slice(2),u)}... L11: `,"utf-8"),await w(o,t)}function m(t){return/^\d+\.\d+\.\d+

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

update-helper.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @arcforge/axon@2.0.23 matchedIdentity = npm:QGFyY2ZvcmdlL2F4b24:2.0.23 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

update-helper.jsView on unpkg

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 22844295 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

index.jsView on unpkg

•path = index.js kind = oversized_cli_entrypoint sizeBytes = 22844295 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

index.jsView on unpkg

@arcforge/axon@2.0.26

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code