@broxium/cli@1.11.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@broxium/cli@1.11.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/commands/update.jsView file

3exports.updateCommand = updateCommand; L4: const child_process_1 = require("child_process"); L5: const banner_1 = require("../utils/banner");

High

Child Process

Package source references child process execution.

dist/commands/update.jsView on unpkg · L3

43console.log(" Installing…\n"); L44: const result = (0, child_process_1.spawnSync)("npm", ["install", "-g", `${pkg}@${latest}`], { L45: stdio: "inherit", ... L48: if (result.status !== 0) { L49: (0, banner_1.printError)("Update failed. Try manually: npm install -g @broxium/cli"); L50: if (process.platform !== "win32") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/update.jsView on unpkg · L43

dist/commands/login.jsView file

51// ── Credential store: ~/.broxium/credentials.json ───────────────────────── L52: const CRED_DIR = path.join(os.homedir(), ".broxium"); L53: const CRED_FILE = path.join(CRED_DIR, "credentials.json"); ... L73: deviceId, L74: deviceName: `${os.hostname()} (${os.platform()})`, L75: os: `${os.platform()} ${os.release()}`, ... L115: name: "endpoint", L116: message: "Brodox Core endpoint " + chalk_1.default.dim("(e.g. https://core.yourplatform.com)") + ":", L117: validate: (v) => v.trim().startsWith("http") ? true : "Must be a valid URL", ... L141: headers: { "Content-Type": "application/json" }, L142: body: JSON.stringify({ email, token, fingerprint }), L143: });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/login.jsView on unpkg · L51

dist/commands/publish.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @broxium/cli@1.10.1 matchedIdentity = npm:QGJyb3hpdW0vY2xp:1.10.1 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/publish.jsView on unpkg

Source & flagged code

4 flagged

dist/commands/update.jsView file

Lines 1-58javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.updateCommand = updateCommand;

4const child_process_1 = require("child_process");

5const banner_1 = require("../utils/banner");

High

Child Process

Package source references child process execution.

dist/commands/update.jsView on unpkg · L3

6const version_1 = require("../version");

7function getLatestVersion(pkg) {

8 const result = (0, child_process_1.spawnSync)("npm", ["view", pkg, "version"], { encoding: "utf-8" });

9 if (result.error || result.status !== 0)

10 throw new Error("Could not fetch latest version from npm registry");

11 return result.stdout.trim();

12}

13function isGlobalInstall() {

14 try {

15 const globalBin = (0, child_process_1.execSync)("npm root -g", { encoding: "utf-8" }).trim();

16 const selfBin = (0, child_process_1.execSync)("npm root", { encoding: "utf-8", cwd: __dirname }).trim();

17 return selfBin.startsWith(globalBin);

18 }

19 catch {

20 return false;

21 }

22}

23async function updateCommand() {

24 const pkg = "@broxium/cli";

25 console.log(`\n\x1b[35m◆ Broxium Self-Update\x1b[0m\n`);

26 (0, banner_1.printInfo)(`Current version: \x1b[1m${version_1.VERSION}\x1b[0m`);

27 let latest;

28 try {

29 process.stdout.write(" Checking npm registry… ");

30 latest = getLatestVersion(pkg);

31 process.stdout.write(`\x1b[32m${latest}\x1b[0m\n`);

32 }

33 catch (e) {

34 process.stdout.write("\n");

35 (0, banner_1.printError)(`Could not reach npm registry: ${e.message}`);

36 process.exit(1);

37 }

38 if (latest === version_1.VERSION) {

39 (0, banner_1.printSuccess)(`Already on the latest version (${version_1.VERSION}). Nothing to do.`);

40 return;

41 }

42 console.log(`\n New version available: \x1b[32m${latest}\x1b[0m (current: \x1b[33m${version_1.VERSION}\x1b[0m)`);

43 console.log(" Installing…\n");

44 const result = (0, child_process_1.spawnSync)("npm", ["install", "-g", `${pkg}@${latest}`], {

45 stdio: "inherit",

46 encoding: "utf-8",

47 });

48 if (result.status !== 0) {

49 (0, banner_1.printError)("Update failed. Try manually: npm install -g @broxium/cli");

50 if (process.platform !== "win32") {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/update.jsView on unpkg · L43

51 (0, banner_1.printInfo)("On macOS/Linux you may need: sudo npm install -g @broxium/cli");

52 }

53 process.exit(1);

54 }

55 console.log();

56 (0, banner_1.printSuccess)(`Updated to ${latest}! Run \x1b[1mbroxium -v\x1b[0m to confirm.`);

57}

58

dist/commands/login.jsView file

Lines 31-71javascript

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35var __importDefault = (this && this.__importDefault) || function (

dist/commands/publish.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @broxium/cli@1.10.1 matchedIdentity = npm:QGJyb3hpdW0vY2xp:1.10.1 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/publish.jsView on unpkg