@boxes-dev/dvb-runtime@1.0.995: Malicious npm security report | LPM Firewall

Loading npm security reports…

@boxes-dev/dvb-runtime@1.0.995: Malicious npm security report | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/bin/dvbd.mjsView file

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/dvbd.mjsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/bin/dvbd.cjs -> dist/bin/dvbd.mjs L7: const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/dvbd.mjsView on unpkg · L7

29791}; L29792: Writer.prototype.fork = function fork() { L29793: this.states = new State(this);

High

Child Process

Package source references child process execution.

dist/bin/dvbd.mjsView on unpkg · L29791

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_source_file sizeBytes = 6006392 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_cli_entrypoint sizeBytes = 6006392 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvbd.mjsView on unpkg

dist/boxes-mosh/linux-arm64/mosh-clientView file

•path = dist/boxes-mosh/linux-arm64/mosh-client kind = native_binary sizeBytes = 8307136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/boxes-mosh/linux-arm64/mosh-clientView on unpkg

dist/boxes-mosh/linux-arm64/notices.tar.gzView file

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = high_entropy_blob sizeBytes = 19268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = compressed_blob sizeBytes = 19268 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

Source & flagged code

11 flagged

dist/bin/dvbd.mjsView file

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Download Execute

Source downloads or fetches remote code and executes it.

dist/bin/dvbd.mjsView on unpkg · L7

7Trigger-reachable chain: manifest.bin -> dist/bin/dvbd.cjs -> dist/bin/dvbd.mjs L7: const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin/dvbd.mjsView on unpkg · L7

29791}; L29792: Writer.prototype.fork = function fork() { L29793: this.states = new State(this);

High

Child Process

Package source references child process execution.

dist/bin/dvbd.mjsView on unpkg · L29791

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin/dvbd.mjs: delete opts.headers.authorization; if (opts.auth && !options.headers.authorization) { options.headers.authorization = "Basic " + Buffer.from(opts.auth).toString("base64"); authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string2()).optional(), authorization_endpoint: SafeUrlSchema, authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0) authorization_endpoint: SafeUrlSchema,

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin/dvbd.mjsView on unpkg

7const require = __dvbCreateRequire(import.meta.url); L8: const __dirname = __dvbDirname(__dvbFileURLToPath(import.meta.url)); L9: var __create = Object.create; ... L70: kStatusCode: /* @__PURE__ */ Symbol("status-code"), L71: kWebSocket: /* @__PURE__ */ Symbol("websocket"), L72: NOOP: () => { ... L123: } else { L124: buf = Buffer.from(data); L125: toBuffer.readOnly = false; ... L135: }; L136: if (!process.env.WS_NO_BUFFER_UTIL) { L137: try {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bin/dvbd.mjsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_source_file sizeBytes = 6006392 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin/dvbd.mjsView on unpkg

•path = dist/bin/dvbd.mjs kind = oversized_cli_entrypoint sizeBytes = 6006392 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin/dvbd.mjsView on unpkg

dist/boxes-mosh/linux-arm64/mosh-clientView file

•path = dist/boxes-mosh/linux-arm64/mosh-client kind = native_binary sizeBytes = 8307136 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/boxes-mosh/linux-arm64/mosh-clientView on unpkg

dist/boxes-mosh/linux-arm64/notices.tar.gzView file

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = high_entropy_blob sizeBytes = 19268 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg

•path = dist/boxes-mosh/linux-arm64/notices.tar.gz kind = compressed_blob sizeBytes = 19268 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/boxes-mosh/linux-arm64/notices.tar.gzView on unpkg