@brightsideoy/kama@0.1.0-alpha.155: Manual Review npm security | LPM Firewall

Loading npm security reports…

@brightsideoy/kama@0.1.0-alpha.155: Manual Review npm security | LPM Firewall

Source & flagged code

9 flagged · loading source

bin/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.121 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.121 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

1#!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, statSync, unlinkSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L1: #!/usr/bin/env node L2: import { execSync } from 'node:child_process'; L3: import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, statSync, unlinkSync, appendFileSync } from 'node:fs'; ... L9: const __filename = fileURLToPath(import.meta.url); L10: const __dirname = dirname(__filename); L11: let currentKamaVersion = 'alpha'; L12: try { L13: const pkgPath = join(__dirname, '../package.json'); L14: if (existsSync(pkgPath)) { L15: const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8')); L16: if (pkg.version) currentKamaVersion = `^${pkg.version}`; ... L23: input: process.stdin,

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

170try { L171: execSync('npx wrangler whoami', { stdio: 'pipe' }); L172: isAuthenticated = true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L170

574const compilerUrl = pathToFileURL(compilerPath).href; L575: await import(compilerUrl); L576: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L574

npm-test.shView file

•path = npm-test.sh kind = build_helper sizeBytes = 2152 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

npm-test.shView on unpkg

.wrangler/state/v3/cache/default/blobs/97205d84c3e4399f6f51295e8381b21f2a8810cdaecc0ab13f2cadf712fae5f4000001a0b339609dView file

•path = .[redacted] kind = high_entropy_blob sizeBytes = 227409 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.wrangler/state/v3/cache/default/blobs/97205d84c3e4399f6f51295e8381b21f2a8810cdaecc0ab13f2cadf712fae5f4000001a0b339609dView on unpkg

•path = .[redacted] kind = payload_in_excluded_dir sizeBytes = 227409 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.wrangler/state/v3/cache/default/blobs/97205d84c3e4399f6f51295e8381b21f2a8810cdaecc0ab13f2cadf712fae5f4000001a0b339609dView on unpkg

dist/assets/index-DGHRgyms.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DGHRgyms.jsView on unpkg

Source & flagged code

9 flagged

bin/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync, cpSync, statSync, unlinkSync, appendFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L1

4import { join, dirname, basename, resolve, relative } from 'node:path';

5import { fileURLToPath, pathToFileURL } from 'node:url';

6import * as readline from 'node:readline/promises';

7

8// Dynamically resolve current package version

9const __filename = fileURLToPath(import.meta.url);

10const __dirname = dirname(__filename);

11let currentKamaVersion = 'alpha';

12try {

13 const pkgPath = join(__dirname, '../package.json');

14 if (existsSync(pkgPath)) {

15 const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));

16 if (pkg.version) currentKamaVersion = `^${pkg.version}`;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/cli.jsView on unpkg · L1

17 }

18} catch (e) {

19 console.warn("⚠️ Could not detect Kama version, defaulting to 'alpha'");

20}

21

Lines 150-190javascript

150

151 writeFileSync(

152 join(rootDir, '.gitignore'),

153 `node_modules/\n.env\n.DS_Store\nkama-worker/.dev.vars\nkama-worker/.env\nkama-worker/.wrangler/\nkama-worker/public/\nkama-worker/*.db\nsites/*/.env\n

Lines 554-594javascript

554 console.log(`🌱 Run 'npm run dev' to boot up and seed the new site data.`);

555}

556

557/**

558 * COMMAND: npx kama bundle

559 */

560async function bundleWorkspaceSchemas(targetRootDir) {

561 let rootDir =

•matchType = previous_version_dangerous_delta matchedPackage = @brightsideoy/kama@0.1.0-alpha.121 matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.121 similarity = 0.591 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/cli.jsView on unpkg

npm-test.shView file

•path = npm-test.sh kind = build_helper sizeBytes = 2152 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

npm-test.shView on unpkg

.wrangler/state/v3/cache/default/blobs/97205d84c3e4399f6f51295e8381b21f2a8810cdaecc0ab13f2cadf712fae5f4000001a0b339609dView file

•path = .[redacted] kind = high_entropy_blob sizeBytes = 227409 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.wrangler/state/v3/cache/default/blobs/97205d84c3e4399f6f51295e8381b21f2a8810cdaecc0ab13f2cadf712fae5f4000001a0b339609dView on unpkg

•path = .[redacted] kind = payload_in_excluded_dir sizeBytes = 227409 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.wrangler/state/v3/cache/default/blobs/97205d84c3e4399f6f51295e8381b21f2a8810cdaecc0ab13f2cadf712fae5f4000001a0b339609dView on unpkg

dist/assets/index-DGHRgyms.jsView file

•matchType = normalized_sha256 matchedPackage = @brightsideoy/kama@0.1.0-alpha.114 matchedPath = dist/assets/index-DcFVWhF4.js matchedIdentity = npm:QGJyaWdodHNpZGVveS9rYW1h:0.1.0-alpha.114 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/index-DGHRgyms.jsView on unpkg