@boxes-dev/dvb-runtime@1.0.1026: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@boxes-dev/dvb-runtime@1.0.1026: Suspicious npm security report | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/bin/dvbd.mjsView file

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/dvbd.mjsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/bin/dvbd.cjs -> dist/bin/dvbd.mjs L7: const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/dvbd.mjsView on unpkg · L7

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/dvbd.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4b991e957ea611c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_source_file sizeBytes = 6006396 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_cli_entrypoint sizeBytes = 6006396 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvbd.mjsView on unpkg

dist/boxes-mosh/linux-arm64/mosh-clientView file

•path = dist/boxes-mosh/linux-arm64/mosh-client kind = native_binary sizeBytes = 8307136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/boxes-mosh/linux-arm64/mosh-clientView on unpkg

dist/boxes-mosh/linux-arm64/notices.tar.gzView file

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = high_entropy_blob sizeBytes = 19268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = compressed_blob sizeBytes = 19268 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

Source & flagged code

12 flagged

dist/bin/dvbd.mjsView file

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/dvbd.mjsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/bin/dvbd.cjs -> dist/bin/dvbd.mjs L7: const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/dvbd.mjsView on unpkg · L7

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/dvbd.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4b991e957ea611c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_source_file sizeBytes = 6006396 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_cli_entrypoint sizeBytes = 6006396 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvbd.mjsView on unpkg

dist/boxes-mosh/linux-arm64/mosh-clientView file

•path = dist/boxes-mosh/linux-arm64/mosh-client kind = native_binary sizeBytes = 8307136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/boxes-mosh/linux-arm64/mosh-clientView on unpkg

dist/boxes-mosh/linux-arm64/notices.tar.gzView file

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = high_entropy_blob sizeBytes = 19268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = compressed_blob sizeBytes = 19268 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg