@boxes-dev/dvb-runtime@1.0.1054: Unknown npm security report | LPM Firewall

Loading npm security reports…

@boxes-dev/dvb-runtime@1.0.1054: Unknown npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/bin/dvbd.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @boxes-dev/dvb-runtime@1.0.1052 matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.1052 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

46894exports.execAsync = void 0; L46895: var child_process = __require("child_process"); L46896: var util2 = __require("util");

High

Child Process

Package source references child process execution.

dist/bin/dvbd.mjsView on unpkg · L46894

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L63: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L64: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L65: NOOP: () => { ... L116: } else { L117: buf = Buffer.from(data); L118: toBuffer.readOnly = false; ... L128: }; L129: if (!process.env.WS_NO_BUFFER_UTIL) { L130: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

19270if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L19271: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L19272: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin/dvbd.mjsView on unpkg · L19270

dist/postgres-tools/linux-arm64/bin/pg_restoreView file

•path = dist/postgres-tools/linux-arm64/bin/pg_restore kind = native_binary sizeBytes = 200536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/postgres-tools/linux-arm64/bin/pg_restoreView on unpkg

dist/bin/dvb.mjsView file

•path = dist/bin/dvb.mjs kind = oversized_source_file sizeBytes = 11981108 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvb.mjsView on unpkg

•path = dist/bin/dvb.mjs kind = oversized_cli_entrypoint sizeBytes = 11981108 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvb.mjsView on unpkg

Source & flagged code

8 flagged

dist/bin/dvbd.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @boxes-dev/dvb-runtime@1.0.1052 matchedIdentity = npm:QGJveGVzLWRldi9kdmItcnVudGltZQ:1.0.1052 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/dvbd.mjsView on unpkg

46894exports.execAsync = void 0; L46895: var child_process = __require("child_process"); L46896: var util2 = __require("util");

High

Child Process

Package source references child process execution.

dist/bin/dvbd.mjsView on unpkg · L46894

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L63: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L64: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L65: NOOP: () => { ... L116: } else { L117: buf = Buffer.from(data); L118: toBuffer.readOnly = false; ... L128: }; L129: if (!process.env.WS_NO_BUFFER_UTIL) { L130: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

19270if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L19271: const validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L19272: this.scope.value(validateName, { ref: validate });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/bin/dvbd.mjsView on unpkg · L19270

dist/postgres-tools/linux-arm64/bin/pg_restoreView file

•path = dist/postgres-tools/linux-arm64/bin/pg_restore kind = native_binary sizeBytes = 200536 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/postgres-tools/linux-arm64/bin/pg_restoreView on unpkg

dist/bin/dvb.mjsView file

•path = dist/bin/dvb.mjs kind = oversized_source_file sizeBytes = 11981108 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvb.mjsView on unpkg

•path = dist/bin/dvb.mjs kind = oversized_cli_entrypoint sizeBytes = 11981108 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvb.mjsView on unpkg