@aseity/lyra@0.11.5: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@aseity/lyra@0.11.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/index.jsView file

1692`)} L1693: `}function Qg(t,e=!1){return t.length<=_c&&!e?t:t.length<=_c?t+jA:t.slice(0,_c)+jA}function Mt(t,e){if(typeof t!="function")throw new p(`DeepSeek Harness filesystem sandbox session... L1694:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1692

1857${r}${o} L1858: `}function Rz(t){let e=t.split(/\r?\n/);if(e[0]?.trim()!=="---")return{};let n=e.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of e.slice(1,n)){let ... L1859: `).replace(/\r/gu,` ... L1863: `),numLines:l.length,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:u}=xy(e,t.headLimit,t.offset),l=a.ma... L1864: `),numMatches:c,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}let{items:r,appliedLimit:i}=xy(e,t.headLimit,t.offset),s=r.map(n);return{mode:o,nu... L1865: import pty

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1857

1857${r}${o} L1858: `}function Rz(t){let e=t.split(/\r?\n/);if(e[0]?.trim()!=="---")return{};let n=e.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of e.slice(1,n)){let ... L1859: `).replace(/\r/gu,` ... L1863: `),numLines:l.length,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:u}=xy(e,t.headLimit,t.offset),l=a.ma... L1864: `),numMatches:c,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}let{items:r,appliedLimit:i}=xy(e,t.headLimit,t.offset),s=r.map(n);return{mode:o,nu... L1865: import pty

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1857

29package = @aseity/lyra; repositoryIdentity = max; dependency = @modelcontextprotocol/client L29: npm install @modelcontextprotocol/client L30: `.trim()),t}function tm(t){return t.content=Yp(t.content,{_meta:t._meta,structuredContent:t.structuredContent,isError:t.isError}),t}function be(t,e){let o={...(t===void 0?void 0:{t... L31: `);return`Tool input validation failed${n}:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L29

•matchType = normalized_sha256 matchedPackage = @aseity/lyra@0.11.1 matchedPath = dist/index.js matchedIdentity = npm:QGFzZWl0eS9seXJh:0.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

1/*! Author: Ty <ty29022@gmail.com> */ L2: var dv=Object.defineProperty;var h=(t,e)=>()=>(t&&(e=t(t=0)),e);var pv=(t,e)=>{for(var n in e)dv(t,n,{get:e[n],enumerable:!0})};var Me,p,ro,Li,Ni,io,wn,Zt,Qt,rr,ir,sr,$i,F,Fa,Ui,k=... L3: `)),n.length>0?n.join(` ... L14: `)}}function go(t,e,n){if(n.length===0)return;let o=t[t.length-1];if(o?.role===e){o.content.push(...n);return}t.push({role:e,content:[...n]})}function Hk(t,e,n){return typeof t=="s... L15: `):t.type==="text"?t.text:JSON.stringify(t)}function dP(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>e.type==="input_text"?{type:"text",text:e.text}:e.type==="input_ima... L16: `),imageContent:o}}if(Mn(t)&&t.type==="text"&&typeof t.text=="string")return{toolContent:t.text,imageContent:[]};if(Mn(t)&&t.type==="image"){let n=KP(t),o=

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/index.cjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: `):t.type==="text"?t.text:JSON.stringify(t)}function cP(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>e.type==="input_text"?{type:"text",text:e.text}:e.type==="input_ima... `):t.type==="text"?t.text:JSON.stringify(t)}function $P(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>e.type==="input_text"?{type:"text",text:e.text}:e.type==="input_ima... `,"utf8")}catch{}}async function*EE(t,e,n){let o=0;try{for await(let r of t)await Lo({type:"stream_chunk",requestId:e,model:n,chunkIndex:o,chunk:r}),o++,yield r;await Lo({type:"str... `),imageContent:o}}if(t.type==="text")return{toolContent:t.text,imageConten

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

1857Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1857: ${r}${o} L1858: `}function nz(t){let e=t.split(/\r?\n/);if(e[0]?.trim()!=="---")return{};let n=e.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of e.slice(1,n)){let ... L1859: `).replace(/\r/gu,` ... L1863: `),numLines:l.length,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:u}=eh(e,t.headLimit,t.offset),l=a.ma... L1864: `),numMatches:c,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}let{items:r,appliedLimit:i}=eh(e,t.headLimit,t.offset),s=r.map(n);return{mode:o,nu... L1865: import pty

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1857

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @aseity/lyra@0.11.0 matchedPath = dist/index.d.ts matchedIdentity = npm:QGFzZWl0eS9seXJh:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.d.tsView on unpkg

Source & flagged code

12 flagged

dist/index.jsView file

1692`)} L1693: `}function Qg(t,e=!1){return t.length<=_c&&!e?t:t.length<=_c?t+jA:t.slice(0,_c)+jA}function Mt(t,e){if(typeof t!="function")throw new p(`DeepSeek Harness filesystem sandbox session... L1694:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1692

1857${r}${o} L1858: `}function Rz(t){let e=t.split(/\r?\n/);if(e[0]?.trim()!=="---")return{};let n=e.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of e.slice(1,n)){let ... L1859: `).replace(/\r/gu,` ... L1863: `),numLines:l.length,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:u}=xy(e,t.headLimit,t.offset),l=a.ma... L1864: `),numMatches:c,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}let{items:r,appliedLimit:i}=xy(e,t.headLimit,t.offset),s=r.map(n);return{mode:o,nu... L1865: import pty

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1857

1857${r}${o} L1858: `}function Rz(t){let e=t.split(/\r?\n/);if(e[0]?.trim()!=="---")return{};let n=e.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of e.slice(1,n)){let ... L1859: `).replace(/\r/gu,` ... L1863: `),numLines:l.length,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:u}=xy(e,t.headLimit,t.offset),l=a.ma... L1864: `),numMatches:c,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}let{items:r,appliedLimit:i}=xy(e,t.headLimit,t.offset),s=r.map(n);return{mode:o,nu... L1865: import pty

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1857

29package = @aseity/lyra; repositoryIdentity = max; dependency = @modelcontextprotocol/client L29: npm install @modelcontextprotocol/client L30: `.trim()),t}function tm(t){return t.content=Yp(t.content,{_meta:t._meta,structuredContent:t.structuredContent,isError:t.isError}),t}function be(t,e){let o={...(t===void 0?void 0:{t... L31: `);return`Tool input validation failed${n}:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L29

•matchType = normalized_sha256 matchedPackage = @aseity/lyra@0.11.1 matchedPath = dist/index.js matchedIdentity = npm:QGFzZWl0eS9seXJh:0.11.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

1/*! Author: Ty <ty29022@gmail.com> */ L2: var dv=Object.defineProperty;var h=(t,e)=>()=>(t&&(e=t(t=0)),e);var pv=(t,e)=>{for(var n in e)dv(t,n,{get:e[n],enumerable:!0})};var Me,p,ro,Li,Ni,io,wn,Zt,Qt,rr,ir,sr,$i,F,Fa,Ui,k=... L3: `)),n.length>0?n.join(` ... L14: `)}}function go(t,e,n){if(n.length===0)return;let o=t[t.length-1];if(o?.role===e){o.content.push(...n);return}t.push({role:e,content:[...n]})}function Hk(t,e,n){return typeof t=="s... L15: `):t.type==="text"?t.text:JSON.stringify(t)}function dP(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>e.type==="input_text"?{type:"text",text:e.text}:e.type==="input_ima... L16: `),imageContent:o}}if(Mn(t)&&t.type==="text"&&typeof t.text=="string")return{toolContent:t.text,imageContent:[]};if(Mn(t)&&t.type==="image"){let n=KP(t),o=

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/index.cjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: `):t.type==="text"?t.text:JSON.stringify(t)}function cP(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>e.type==="input_text"?{type:"text",text:e.text}:e.type==="input_ima... `):t.type==="text"?t.text:JSON.stringify(t)}function $P(t){return typeof t=="string"?t:Array.isArray(t)?t.map(e=>e.type==="input_text"?{type:"text",text:e.text}:e.type==="input_ima... `,"utf8")}catch{}}async function*EE(t,e,n){let o=0;try{for await(let r of t)await Lo({type:"stream_chunk",requestId:e,model:n,chunkIndex:o,chunk:r}),o++,yield r;await Lo({type:"str... `),imageContent:o}}if(t.type==="text")return{toolContent:t.text,imageConten

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

1857Trigger-reachable command-output exfiltration chain: manifest.main -> dist/index.cjs L1857: ${r}${o} L1858: `}function nz(t){let e=t.split(/\r?\n/);if(e[0]?.trim()!=="---")return{};let n=e.findIndex((r,i)=>i>0&&r.trim()==="---");if(n===-1)return{};let o={};for(let r of e.slice(1,n)){let ... L1859: `).replace(/\r/gu,` ... L1863: `),numLines:l.length,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}if(o==="count"){let{items:a,appliedLimit:u}=eh(e,t.headLimit,t.offset),l=a.ma... L1864: `),numMatches:c,...u!==void 0?{appliedLimit:u}:{},...(t.offset??0)>0?{appliedOffset:t.offset}:{}}}let{items:r,appliedLimit:i}=eh(e,t.headLimit,t.offset),s=r.map(n);return{mode:o,nu... L1865: import pty

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.cjsView on unpkg · L1857

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/index.d.tsView file

•matchType = normalized_sha256 matchedPackage = @aseity/lyra@0.11.0 matchedPath = dist/index.d.ts matchedIdentity = npm:QGFzZWl0eS9seXJh:0.11.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.d.tsView on unpkg