@avi892nash/aegis-grid-runner@0.2.0: Suspicious npm security | LPM Firewall

Loading npm security reports…

@avi892nash/aegis-grid-runner@0.2.0: Suspicious npm security | LPM Firewall

Source & flagged code

4 flagged · loading source

grid.mjsView file

6// remote/server.mjs L7: import { createServer } from "node:http"; L8: import { randomUUID, createHash } from "node:crypto"; ... L22: import { fileURLToPath, pathToFileURL } from "node:url"; L23: import { spawn } from "node:child_process"; L24: var HERE = dirname(fileURLToPath(import.meta.url)); L25: var PORT = Number(process.env.GRID_PORT ?? 7717); L26: var DATA = resolve(process.env.GRID_DATA ?? ".grid"); ... L491: const flash = () => { if(!btn) return; btn.textContent = 'copied'; setTimeout(()=>{ btn.textContent = restore; }, 1200); }; L492: try{ if(navigator.clipboard && navigator.clipboard.writeText){ await navigator.clipboard.writeText(text); flash(); return; } }catch{} L493: try{ ... L527: try{

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

grid.mjsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> bin.mjs -> grid.mjs L6: // remote/server.mjs L7: import { createServer } from "node:http"; L8: import { randomUUID, createHash } from "node:crypto"; ... L22: import { fileURLToPath, pathToFileURL } from "node:url"; L23: import { spawn } from "node:child_process"; L24: var HERE = dirname(fileURLToPath(import.meta.url)); L25: var PORT = Number(process.env.GRID_PORT ?? 7717); L26: var DATA = resolve(process.env.GRID_DATA ?? ".grid"); ... L491: const flash = () => { if(!btn) return; btn.textContent = 'copied'; setTimeout(()=>{ btn.textContent = restore; }, 1200); }; L492: try{ if(navigator.clipboard && navigator.clipboard.writeText){ await navigator.clipboard.writeText(text); flash(); return; } }catch{} L493: try{ ... L527: try{

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

grid.mjsView on unpkg · L6

22import { fileURLToPath, pathToFileURL } from "node:url"; L23: import { spawn } from "node:child_process"; L24: var HERE = dirname(fileURLToPath(import.meta.url));

High

Child Process

Package source references child process execution.

grid.mjsView on unpkg · L22

3257var buildsSync = { manifestOk: false, running: false, lastOk: 0, downloaded: 0, failed: 0 }; L3258: var RUNNER_ID = process.env.GRID_RUNNER_ID ?? `${hostname()}-${process.pid}`; L3259: var RUNNER_PORT_BASE = Math.max(1, Number(process.env.GRID_RUNNER_PORT ?? 7719)); ... L3266: var masterHdrs = () => ({ "content-type": "application/json", ...masterToken ? { "x-grid-token": masterToken } : {} }); L3267: var api = (p, init = {}) => fetch(`${masterUrl}${p}`, { ...init, headers: { ...masterHdrs(), ...init.headers ?? {} } }); L3268: var sh = (cmd2, args) => { L3269: try { L3270: return execFileSync(cmd2, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }); L3271: } catch {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

grid.mjsView on unpkg · L3257

Source & flagged code

4 flagged

grid.mjsView file

Lines 1-42javascript

1#!/usr/bin/env node

2

3// <define:__GRID_BUILD__>

4var define_GRID_BUILD_default = { version: "1.0.0", gitSha: "2cf4b206", builtAt: "2026-07-30T12:31:24.440Z" };

5

6// remote/server.mjs

7import { createServer } from "node:http";

8import { randomUUID, createHash } from "node:crypto";

9import {

10 mkdirSync,

11 createWriteStream,

12 createReadStream,

13 existsSync,

14 writeFileSync,

15 readFileSync,

16 readdirSync,

17 statSync,

18 renameSync,

19 rmSync

20} from "node:fs";

21import { resolve, dirname, basename, sep } from "node:path";

22import { fileURLToPath, pathToFileURL } from "node:url";

23import { spawn } from "node:child_process";

24var HERE = dirname(fileURLToPath(import.meta.url));

High

Child Process

Package source references child process execution.

grid.mjsView on unpkg · L22

25var PORT = Number(process.env.GRID_PORT ?? 7717);

26var DATA = resolve(process.env.GRID_DATA ?? ".grid");

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

grid.mjsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

grid.mjsView on unpkg · L6

27var CATALOG_DIR = resolve(DATA, "catalog");

28var TOKEN = process.env.GRID_TOKEN ?? "";

29var PUBLIC_URL = (process.env.GRID_PUBLIC_URL ?? "").trim().replace(/\/+$/, "");

30var BUNDLED = true;

31var BUILD = typeof define_GRID_BUILD_default !== "undefined" ? define_GRID_BUILD_default : { version: "dev", gitSha: "dev", builtAt: null };

32var UI_HTML = true ? `<!doctype html>

33<html lang="en">

34<head>

35<meta charset="utf-8">

36<meta name="viewport" content="width=device-width, initial-scale=1">

37<title>WDIO Grid</title>

38<!--

39 GRID WORKBENCH \u2014 single-window, Katalon-Studio-like console for the master.

40 Vanilla JS, no build step, no CDNs, single self-contained file served by

41 server.mjs. Live state comes over SSE (GET /api/events); actions go to the

42 JSON APIs. NOTHING about the job/run submit model changed \u2014 the New-run form

Lines 3237-3277javascript

3237var paired = false;

3238var pairingSource = null;

3239var WEB_SLOTS = Math.max(0, Number(process.env.GRID_WEB_SLOTS ?? 2