Loading npm security reports…

@boxes-dev/dvb@1.0.820: Suspicious npm security report (Warn) | LPM Firewall

registry / @boxes-dev/dvb / 1.0.820

@boxes-dev/dvb@1.0.820

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

Manifest

NoLicenseWildcardDependency

scanned 4 file(s), 457 KB of source, external domains: deploy.boxes.dev, registry.npmjs.org

Source & flagged code

2 flagged

package.jsonView file

Lines 7-40json

7 "access": "public"

8 },

9 "bin": {

10 "dvb": "dist/bin/dvb.cjs",

11 "dvbd": "dist/bin/dvbd.cjs",

12 "dvb-update": "dist/bin/dvb-update.cjs"

13 },

14 "files": [

15 "dist/bin/dvb.cjs",

16 "dist/bin/dvb.cjs.map",

17 "dist/bin/dvbd.cjs",

18 "dist/bin/dvbd.cjs.map",

19 "dist/bin/dvb-update.cjs",

20 "dist/bin/dvb-update.cjs.map",

21 "scripts/postinstall.cjs"

22 ],

23 "scripts": {

24 "build": "npm run build:bundle",

25 "build:bundle": "node ./scripts/build-bundle.mjs",

26 "prepack": "npm run clean && npm run build",

27 "postinstall": "node ./scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "typecheck": "tsc -b",

29 "lint": "npm run typecheck",

30 "clean": "rm -rf dist tsconfig.tsbuildinfo"

31 },

32 "engines": {

33 "node": ">=22"

34 },

35 "dependencies": {

36 "@boxes-dev/dvb-runtime": "*",

37 "tar": "^7.5.1"

38 }

39}

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

Findings

1 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowUrl Strings

LowNo License