@brightsideoy/kama@0.1.0-alpha.138: Unknown npm security report | LPM Firewall

Loading npm security reports…

@brightsideoy/kama@0.1.0-alpha.138: Unknown npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

bin/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.121 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.121 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

1#!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, statSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: sensitive-file+network, execution+network L1: #!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, statSync, appendFileSync } from 'node:fs'; ... L9: const __filename = fileURLToPath(import.meta.url); L10: const __dirname = dirname(__filename); L11: let currentKamaVersion = 'alpha'; L12: try { L13: const pkgPath = join(__dirname, '../package.json'); L14: if (existsSync(pkgPath)) { L15: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L16: if (pkg.version) currentKamaVersion = `^${pkg.version}`; ... L23: input: process.stdin,

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

180try { L181: execSync('npx wrangler whoami', { stdio: 'pipe' }); L182: isAuthenticated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L180

dist/assets/index-DrAVYz6F.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DrAVYz6F.jsView on unpkg

Source & flagged code

5 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, unlinkSync, statSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename, relative, resolve } from 'node:path';

5import { fileURLToPath } from 'node:url';

6import * as readline from 'node:readline/promises';

7

8// Dynamically resolve current package version

9const __filename = fileURLToPath(import.meta.url);

10const __dirname = dirname(__filename);

11let currentKamaVersion = 'alpha';

12try {

13 const pkgPath = join(__dirname, '../package.json');

14 if (existsSync(pkgPath)) {

15 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

16 if (pkg.version) currentKamaVersion = `^${pkg.version}`;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

17 }

18} catch (e) {

19 console.warn("⚠️ Could not detect Kama version, defaulting to 'alpha'");

20}

21

Lines 160-200javascript

160sites/*/.astro/

161sites/*/dist/

162kama-worker/workspace-schemas.js

163`

164 );

165

166 console.log(`\n📄 Copying default content definitions...`);

167 const sourceDefsDir = join(__dirname, '../content/definitions');

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.121 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.121 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

dist/assets/index-DrAVYz6F.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DrAVYz6F.jsView on unpkg