@boxes-dev/dvb-runtime@1.0.1052: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@boxes-dev/dvb-runtime@1.0.1052: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/bin/dvbd.mjsView file

46839exports.execAsync = void 0; L46840: var child_process = __require("child_process"); L46841: var util2 = __require("util");

High

Child Process

Package source references child process execution.

dist/bin/dvbd.mjsView on unpkg · L46839

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4b991e957ea611c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

19277if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L19278: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L19279: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin/dvbd.mjsView on unpkg · L19277

dist/boxes-mosh/linux-arm64/mosh-clientView file

•path = dist/boxes-mosh/linux-arm64/mosh-client kind = native_binary sizeBytes = 8307136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/boxes-mosh/linux-arm64/mosh-clientView on unpkg

dist/boxes-mosh/linux-arm64/notices.tar.gzView file

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = high_entropy_blob sizeBytes = 19268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = compressed_blob sizeBytes = 19268 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

dist/bin/dvb.mjsView file

•path = dist/bin/dvb.mjs kind = oversized_source_file sizeBytes = 11977938 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvb.mjsView on unpkg

•path = dist/bin/dvb.mjs kind = oversized_cli_entrypoint sizeBytes = 11977938 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvb.mjsView on unpkg

Source & flagged code

11 flagged

dist/bin/dvbd.mjsView file

46839exports.execAsync = void 0; L46840: var child_process = __require("child_process"); L46841: var util2 = __require("util");

High

Child Process

Package source references child process execution.

dist/bin/dvbd.mjsView on unpkg · L46839

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4b991e957ea611c9 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @boxes-dev/dvb-runtime@1.0.995 matchedPath = dist/bin/dvbd.mjs matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.995 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

19277if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L19278: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L19279: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin/dvbd.mjsView on unpkg · L19277

dist/boxes-mosh/linux-arm64/mosh-clientView file

•path = dist/boxes-mosh/linux-arm64/mosh-client kind = native_binary sizeBytes = 8307136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/boxes-mosh/linux-arm64/mosh-clientView on unpkg

dist/boxes-mosh/linux-arm64/notices.tar.gzView file

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = high_entropy_blob sizeBytes = 19268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = compressed_blob sizeBytes = 19268 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

dist/bin/dvb.mjsView file

•path = dist/bin/dvb.mjs kind = oversized_source_file sizeBytes = 11977938 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvb.mjsView on unpkg

•path = dist/bin/dvb.mjs kind = oversized_cli_entrypoint sizeBytes = 11977938 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvb.mjsView on unpkg