@baasix/baasix: Suspicious npm security report (Warn)

Loading npm security reports…

@baasix/baasix: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

`dist/services/WorkflowService.js` constructs `new Function` and `AsyncFunction` from workflow scripts.
Workflow scripts receive `axios` and a restricted module loader, creating server-side code-execution capability.

Evidence against

`package.json` contains no `preinstall`, `install`, or `postinstall` lifecycle hook.
`dist/index.js` exports framework modules; no package-install execution path was found.
No package AI-agent configuration filenames or native executable payloads were found.
The flagged `02ff8e9f` bundle identifies Excalidraw UI code; the `120a652c` blob is embedded WASM runtime code.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 546 file(s), 19.9 MB of source, external domains: access.line.me, accounts.google.com, accounts.spotify.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.atlassian.com, api.dropboxapi.com, api.example.com, api.figma.com, api.github.com, api.kick.com, api.line.me, api.linear.app, api.linkedin.com, api.notion.com, api.paypal.com, api.polar.sh, api.sandbox.paypal.com, api.spotify.com, api.vercel.com, api.weixin.qq.com, api.x.com, api.zoom.us, apis.roblox.com, app.excalidraw.com, appleid.apple.com, auth.atlassian.com, backboard.railway.com, bit.ly, cdn.discordapp.com, cdnjs.cloudflare.com, chevrotain.io, discord.com, discord.gg, docs.excalidraw.com, en.wikipedia.org, esm.sh, example.com, excalidraw-room-persistence.firebaseio.com, git.io, github.com, gitlab.com, graph.facebook.com, graph.microsoft.com, huggingface.co, id.kick.com, id.twitch.tv, id.vk.com, idp.paybin.io, json.excalidraw.com

Oversized source lightweight scan

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.js8.36 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinifiedUrlStringslexical.dev

Source & flagged code

12 flagged

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView file

22patternName = aws_access_key severity = critical line = 22 matchedText = `,F.push...}]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView on unpkg · L22

22patternName = aws_access_key severity = critical line = 22 matchedText = `,F.push...}]);

Critical

Secret Pattern

AWS access key ID in dist/app/_next/static/chunks/120a652c.d01da43bdb614574.js

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView on unpkg · L22

dist/app/_next/static/chunks/02ff8e9f.addec78d924043d8.jsView file

Lines 1-21javascript

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2291],{81787:function(e,t,n){n.r(t),n.d(t,{Button:function(){return iY},CaptureUpdateAction:function(){return i.Wg},

2 ${t?"dropdown-menu-item--selected":""} ${n?"dropdown-menu-item--hovered":""}`.trim(),ti=(e,t)=>{let n=(0,o.useContext)(tt);return(0,i.Ib)(e,e=>{let i=new CustomEvent("menu.itemSelect",{bubbles:!0,cancelable:!0});t?.(i),i.defaultPrevented||n.onSelect?.(i)})},ta=({textStyle:e,icon:t,shortcut:n,children:i})=>{let a=or();return(0,h.jsxs)(h.Fragment,{children:[t&&(0,h.jsx)("div",{className:"dropdown-menu-item__icon",children:t}),(0,h.jsx)("div",{style:e,className:"dropdown-menu-item__text",children:i}),n&&!a.editor.isMobile&&(0,h.jsx)("div",{className:"dropdown-menu-item__shortcut",children:n})]} ...

4${U("hints.firefox_clipboard_write")}`):Error(U("alerts.couldNotCopyToClipboard"))}else throw Error("Unsupported export type")},tH=async(e,t,n,a)=>{let{exportBackground:l,viewBackgroundColor

5`),i=[],a=0;for(let e=0;e<n.length;e++){let l=n[e],s=n[e+1];if(s){let e=t.indexOf(s,a);if(e>l.length+a){let t=e-(l.length+a);for(;t>0;)l+=" ",t--}}i.push(l),a+=l.length}return i.join(`

6`)},l3=(e,t,n)=>{let a=l2(e.text,e.originalText).split(`

7`),l=[],s=0,r=0;for(let e of a){let t=s,n=t+e.length-1;l.push({line:e,startIndex:t,endIndex:n,lineNumber:r}),s=n+1,r++}let o=n,d=e.originalText.slice(n,n+t.length),c=[];for(let t of l){if(""===d)break;if(o>=t.startIndex&&o<=t.endIndex){let n=t.endIndex+1-o,a=t.line.slice(0,o-t.startIndex),l=d.slice(0,n);d=d.slice(n);let s=(0,i.vc)(a,(0,i.cb)(e),e.lineHeight);if(""===a&&(s.width=0),"left"!==e.textAlign&&t.line.length>0){let n=(0,i.vc)(t.line,(0,i.cb)(e),e.lineHeight),a="center"===e.textAlign?(e.width-n.width)/2:e.width-n.width;s.width+=a}let{width:r,height:h}=(0,i.vc)(l,(0,i.cb)(e),e.lineHeight ...

8 A[Christmas] -->|Get money| B(Go shopping)

9 B --> C{Let me think}

10 C -->|One| D[Laptop]

11 C -->|Two| E[iPhone]

12 C -->|Three| F[Car]`,sh=(0,i.db)(sn,300),sm=({mermaidToExcalidrawLib:e})=>{let[t,n]=(0,o.useState)(()=>ig.get(i.Ba.MERMAID_TO_EXCALIDRAW)||sc),a=(0,o.useDeferredValue)(t.

13TTD mermaid definition render errror: ${e.message}`,"color: yellow"),ev("ai","mermaid parse failed","ttd"),k(Error("Generated an invalid diagram :(. You may also try a different prompt."))}}catch(t){let e=t.message;e&&"Failed to fetch"!==e||(e="Request failed"),k(Error(e))}finally{g(!1)}},y=(0,o.useRef)(E);y.current=E;let[x,v]=(0,o.useState)({loaded:!1,api:Promise.all([n.e(7853),n.e(4734),n.e(3962),n.e(8848),n.e(4101),n.e(2635)]).then(n.bind(n,86607))});(0,o.useEffect)(()=>{(async()=>{await x.api,v(e=>({...e,loaded:!0}))})()},[x.api]);let w=(0,o.useRef)({elements:[],files:null}),[S,k]=(0,o.use ...

14`).reduce((t,n,i,a)=>t.concat(i?t[i-1]+a[i-1].length+1:e),[]).reverse()},x=e

15 <style>

16 html, body {

17 width: 100%;

18 height: 100%;

19 color: ${this.state.theme===i.G.DARK?"white":"black"};

20 }

21 body {

Long lines were clipped for display.

dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.jsView file

•path = dist/app/_next/static/chunks/37509f09.78557e7c5c381768.js kind = oversized_source_file sizeBytes = 8763361 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.jsView on unpkg

dist/app/_next/static/chunks/2117-7768b6926b20bb34.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.12.5 matchedPath = dist/dashboard/_next/static/chunks/528-7d4fc14903647f1e.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app/_next/static/chunks/2117-7768b6926b20bb34.jsView on unpkg

dist/app/_next/static/chunks/main-735381e3cb6a694a.jsView file

•matchType = normalized_sha256 matchedPackage = @devflow-tools/devflow@0.12.5 matchedPath = dist/dashboard/_next/static/chunks/main-595171e579e3e067.js matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvZGV2Zmxvdw:0.12.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app/_next/static/chunks/main-735381e3cb6a694a.jsView on unpkg

dist/app/_next/static/chunks/1317.1d5e5734255660fc.jsView file

Lines 1-18javascript

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[1317],{59543:function(e,t){"use strict";t.N=void 0;var r=/

dist/app/_next/static/chunks/2898.ca421b1517ce6694.jsView file

Lines 1-1javascript

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2898],{42898:function(e,t,r){r.r(t),r.d(t,{default:function

dist/app/_next/static/chunks/3589.5e336f77c51b1cb2.jsView file

Lines 1-1javascript

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[3589,2950],{7814:function(e,t,n){n.d(t,{Z:function

dist/README.mdView file

Lines 59-99markdown

60### Installation

62```bash

63npm install @baasix/sdk

64```

66### Quick Example

68```typescript

69import { createBaasix } from

README.mdView file

Lines 59-99markdown

60### Installation

62```bash

63npm install @baasix/sdk

64```

66### Quick Example

68```typescript

69import { createBaasix } from

Source & flagged code

12 flagged · loading source

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView file

22patternName = aws_access_key severity = critical line = 22 matchedText = `,F.push...}]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView on unpkg · L22

22patternName = aws_access_key severity = critical line = 22 matchedText = `,F.push...}]);

Critical

Secret Pattern

AWS access key ID in dist/app/_next/static/chunks/120a652c.d01da43bdb614574.js

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView on unpkg · L22

dist/app/_next/static/chunks/02ff8e9f.addec78d924043d8.jsView file

1contains invisible/control Unicode U+202A (left-to-right embedding) "use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2291],{81787:function(e,t,n){n.r(t),n.d(t,{Button:function(){return iY},CaptureUpdateAction:function(){return i.Wg},DEFAULT_LASER_COLOR:function(){return i.y},DefaultSide

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/app/_next/static/chunks/02ff8e9f.addec78d924043d8.jsView on unpkg · L1

dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.jsView file

•path = dist/app/_next/static/chunks/37509f09.78557e7c5c381768.js kind = oversized_source_file sizeBytes = 8763361 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.jsView on unpkg

dist/app/_next/static/chunks/2117-7768b6926b20bb34.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app/_next/static/chunks/2117-7768b6926b20bb34.jsView on unpkg

dist/app/_next/static/chunks/main-735381e3cb6a694a.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app/_next/static/chunks/main-735381e3cb6a694a.jsView on unpkg

dist/app/_next/static/chunks/1317.1d5e5734255660fc.jsView file

12patternName = google_api_key severity = high line = 12 matchedText = or paste...AZZX

High

Secret Pattern

Google API key in dist/app/_next/static/chunks/1317.1d5e5734255660fc.js

dist/app/_next/static/chunks/1317.1d5e5734255660fc.jsView on unpkg · L12

dist/app/_next/static/chunks/2898.ca421b1517ce6694.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in dist/app/_next/static/chunks/2898.ca421b1517ce6694.js

dist/app/_next/static/chunks/2898.ca421b1517ce6694.jsView on unpkg · L1

dist/app/_next/static/chunks/3589.5e336f77c51b1cb2.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = "use str...}]);

Medium

Secret Pattern

Hardcoded password in dist/app/_next/static/chunks/3589.5e336f77c51b1cb2.js

dist/app/_next/static/chunks/3589.5e336f77c51b1cb2.jsView on unpkg · L1

dist/README.mdView file

79patternName = generic_password severity = medium line = 79 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in dist/README.md

dist/README.mdView on unpkg · L79

README.mdView file

79patternName = generic_password severity = medium line = 79 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L79

Source & flagged code

12 flagged

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView file

22patternName = aws_access_key severity = critical line = 22 matchedText = `,F.push...}]);

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView on unpkg · L22

22patternName = aws_access_key severity = critical line = 22 matchedText = `,F.push...}]);

Critical

Secret Pattern

AWS access key ID in dist/app/_next/static/chunks/120a652c.d01da43bdb614574.js

dist/app/_next/static/chunks/120a652c.d01da43bdb614574.jsView on unpkg · L22

dist/app/_next/static/chunks/02ff8e9f.addec78d924043d8.jsView file

Lines 1-21javascript

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2291],{81787:function(e,t,n){n.r(t),n.d(t,{Button:function(){return iY},CaptureUpdateAction:function(){return i.Wg},

4${U("hints.firefox_clipboard_write")}`):Error(U("alerts.couldNotCopyToClipboard"))}else throw Error("Unsupported export type")},tH=async(e,t,n,a)=>{let{exportBackground:l,viewBackgroundColor

5`),i=[],a=0;for(let e=0;e<n.length;e++){let l=n[e],s=n[e+1];if(s){let e=t.indexOf(s,a);if(e>l.length+a){let t=e-(l.length+a);for(;t>0;)l+=" ",t--}}i.push(l),a+=l.length}return i.join(`

6`)},l3=(e,t,n)=>{let a=l2(e.text,e.originalText).split(`

8 A[Christmas] -->|Get money| B(Go shopping)

9 B --> C{Let me think}

10 C -->|One| D[Laptop]

11 C -->|Two| E[iPhone]

12 C -->|Three| F[Car]`,sh=(0,i.db)(sn,300),sm=({mermaidToExcalidrawLib:e})=>{let[t,n]=(0,o.useState)(()=>ig.get(i.Ba.MERMAID_TO_EXCALIDRAW)||sc),a=(0,o.useDeferredValue)(t.

14`).reduce((t,n,i,a)=>t.concat(i?t[i-1]+a[i-1].length+1:e),[]).reverse()},x=e

15 <style>

16 html, body {

17 width: 100%;

18 height: 100%;

19 color: ${this.state.theme===i.G.DARK?"white":"black"};

20 }

21 body {

Long lines were clipped for display.

dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woffView file

•path = dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woff kind = high_entropy_blob sizeBytes = 18748 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/app/_next/static/media/KaTeX_Math-Italic.5295ba48.woffView on unpkg

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.jsView file

•path = dist/app/_next/static/chunks/37509f09.78557e7c5c381768.js kind = oversized_source_file sizeBytes = 8763361 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/app/_next/static/chunks/37509f09.78557e7c5c381768.jsView on unpkg

dist/app/_next/static/chunks/2117-7768b6926b20bb34.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app/_next/static/chunks/2117-7768b6926b20bb34.jsView on unpkg

dist/app/_next/static/chunks/main-735381e3cb6a694a.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/app/_next/static/chunks/main-735381e3cb6a694a.jsView on unpkg

dist/app/_next/static/chunks/1317.1d5e5734255660fc.jsView file

Lines 1-18javascript

1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[1317],{59543:function(e,t){"use strict";t.N=void 0;var r=/

dist/app/_next/static/chunks/2898.ca421b1517ce6694.jsView file

Lines 1-1javascript

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2898],{42898:function(e,t,r){r.r(t),r.d(t,{default:function

dist/app/_next/static/chunks/3589.5e336f77c51b1cb2.jsView file

Lines 1-1javascript

1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[3589,2950],{7814:function(e,t,n){n.d(t,{Z:function

dist/README.mdView file

Lines 59-99markdown

60### Installation

62```bash

63npm install @baasix/sdk

64```

66### Quick Example

68```typescript

69import { createBaasix } from

README.mdView file

Lines 59-99markdown

60### Installation

62```bash

63npm install @baasix/sdk

64```

66### Quick Example

68```typescript

69import { createBaasix } from

@baasix/baasix@0.1.87

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code