Loading npm security reports…

@brightsideoy/kama@0.1.0-alpha.114: Malicious npm security report | LPM Firewall

registry / @brightsideoy/kama / 0.1.0-alpha.114

@brightsideoy/kama@0.1.0-alpha.114

**KAMA is a schema-driven, headless Content Delivery Platform built to give you infinite edge scalability and total deployment flexibility.**

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A published CMS node triggers a remote cache-purge request. When no frontend URL is configured, it sends the Cloudflare API token to kama.t3cloud.eu; it also includes hard-coded t3cloud URLs in the purge set.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Publishing or updating CMS content in a non-local deployment.

Impact

A Cloudflare API token can be exposed to the package vendor endpoint and used outside the consumer's intended deployment.

Mechanism

Remote cache purge with forwarded Cloudflare credentials.

Attack narrative

On content publication, the worker invokes its cache manager. The manager uses kama.t3cloud.eu as a fallback frontend endpoint, attaches CLOUDFLARE_API_TOKEN as a Bearer header, and posts a purge request there. The request includes hard-coded admin.t3cloud.eu URLs, while a related request uses the same token with Cloudflare's purge API. This is an automatic credential-forwarding path unrelated to a consumer-configured endpoint when the fallback is used.

AI rationale

The built runtime automatically forwards a Cloudflare API credential to a package-vendor host and mixes unrelated hard-coded t3cloud URLs into its cache purge flow. This is concrete credential exposure during normal CMS activity, not merely an explicit CLI provisioning action.

Evidence

dist/index.js

Network endpoints3

kama.t3cloud.euadmin.t3cloud.euapi.cloudflare.com

Decision evidence

Source & flagged code

6 flagged · loading source

bin/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.113 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.113 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

1#!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: sensitive-file+network, execution+network L1: #!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync } from 'node:fs'; ... L9: const __filename = fileURLToPath(import.meta.url); L10: const __dirname = dirname(__filename); L11: let currentKamaVersion = 'alpha'; L12: try { L13: const pkgPath = join(__dirname, '../package.json'); L14: if (existsSync(pkgPath)) { L15: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L16: if (pkg.version) currentKamaVersion = `^${pkg.version}`; ... L23: input: process.stdin,

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

148try { L149: execSync('npx wrangler whoami', { stdio: 'pipe' }); L150: isAuthenticated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L148

dist/assets/index-DcFVWhF4.jsView file

1221contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-DcFVWhF4.jsView on unpkg · L1221

test-local.shView file

•path = test-local.sh kind = build_helper sizeBytes = 1975 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-local.shView on unpkg

Source & flagged code

6 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename } from 'node:path';

5import { fileURLToPath } from 'node:url';

6import * as readline from 'node:readline/promises';

7

8// Dynamically resolve current package version

9const __filename = fileURLToPath(import.meta.url);

10const __dirname = dirname(__filename);

11let currentKamaVersion = 'alpha';

12try {

13 const pkgPath = join(__dirname, '../package.json');

14 if (existsSync(pkgPath)) {

15 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

16 if (pkg.version) currentKamaVersion = `^${pkg.version}`;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

17 }

18} catch (e) {

19 console.warn("⚠️ Could not detect Kama version, defaulting to 'alpha'");

20}

21

Lines 128-168javascript

128 'block-layouts',

129 'blocks',

130 'channels',

131 'field-sets',

132 'node-layouts',

133 'nodes',

134 'trees'

135 ];

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.113 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.113 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

dist/assets/index-DcFVWhF4.jsView file

1221contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/assets/index-DcFVWhF4.jsView on unpkg · L1221

test-local.shView file

•path = test-local.sh kind = build_helper sizeBytes = 1975 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test-local.shView on unpkg