@capgo/cli@8.29.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@capgo/cli@8.29.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/src/sdk.jsView file

430patternName = private_key_rsa severity = critical line = 430 matchedText = `||J==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L430

430patternName = private_key_rsa severity = critical line = 430 matchedText = `||J==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L430

439patternName = private_key_rsa severity = critical line = 439 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L439

628patternName = private_key_rsa severity = critical line = 628 matchedText = All pack... J=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L628

259L260: see https://github.com/jprichardson/node-fs-extra/issues/269`);eF.checkPaths(D,Z,"copy",(Y,J)=>{if(Y)return X(Y);let{srcStat:$,destStat:F}=J;eF.checkParentPaths(D,$,Z,"copy",(G)=>{... L261: `)}ke.check=Gc0;async function qc0(D){var Z;if((Z=D.app.extConfig.server)===null||Z===void 0?void 0:Z.url)return null;if(["",".","..","../","./"].includes(D.app.webDir))return`"${D...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L259

119L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Y}=await BF.checkPaths(D,Z,"copy",Q);if(await BF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Y}=EF.checkPathsSync(D,Z,"copy",Q);if(EF.checkParentPathsSync(D,... L123: `,finalEOL:Q=!0,replacer:X=null,spaces:Y}={}){let J=Q?Z:"",$=JSON.stringify(D,X,Y);if($===void 0)throw TypeError(`Converting ${typeof D} value to JSON is not supported`);return $.r... L124: `)];for(let[q,W]of G.entries()){if(X+=W,CH.has(W)){let{groups:U}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(G.slice(q).join(""))||{groups:{}};if(U.code!==void 0)... ... L132: `);return H=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L119

117`)}function nj0(D){if(D)process.env.DEBUG=D;else delete process.env.DEBUG}function ij0(){return process.env.DEBUG}function oj0(D){D.inspectOpts={};let Z=Object.keys(wu.inspectOpts)... L118: `).map((Z)=>Z.trim()).join(" ")};Nu.O=function(D){return this.inspectOpts.colors=this.useColors,VH.inspect(D,this.inspectOpts)}});var OH=A((ZL1,yN)=>{if(typeof process>"u"||process... L119: L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Y}=await BF.checkPaths(D,Z,"copy",Q);if(await BF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Y}=EF.checkPathsSync(D,Z,"copy",Q);if(EF.checkParentPathsSync(D,... L123: `,finalEOL:Q=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L117

94${N}`}});var v_=A((k_)=>{Object.defineProperty(k_,"__esModule",{value:!0});k_.WebAuthnUnknownError=k_.WebAuthnError=void 0;k_.isWebAuthnError=SL0;k_.identifyRegistrationError=xL0;k... L95: `);let w=await K.signMessage(new TextEncoder().encode(V),"utf8");if(!w||!(w instanceof Uint8Array))throw Error("@supabase/auth-js: Wallet signMessage() API returned an recognized v... L96: `)!=-1,X=this._styles,Y=X.length;while(Y--){var J=w5[X[Y]];if(Z=J.open+Z.replace(J.closeRe,J.open)+J.close,Q)Z=Z.replace(xw0,function($){return J.close+$+J.open})}return Z}L1.setTh...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L94

4`){if(J)X+=hI("");let V=Y?fI(Y):void 0;if(Y&&V)X+=vI(V)}else if(U===` L5: `){if(Y&&fI(Y))X+=vI(Y);if(J)X+=hI(J)}}return X},xU0;var eK=o(()=>{rK();tK=`${IU0}8;;`,kI=new RegExp(`(?:\\${bI}(?<code>\\d+)m|\\${tK}(?<uri>.*)${aK})`,"y"),xU0=/\r?\n/});var KD=A(... L6: `),J=0,$=D;for(let G of Y){if($<=G.length)break;$-=G.length+1,J++}for(J=Math.max(0,Math.min(Y.length-1,J+Q)),$=Math.min($,Y[J].length)+Z;$<0&&J>0;)J--,$+=Y[J].length+1;for(;$>Y[J].... L7: `),X=Z.split(` L8: `),Y=Math.max(Q.length,X.length),J=[];for(let $=0;$<Y;$++)Q[$]!==X[$]&&J.push($);return{lines:J,numLinesBefore:Q.length,numLinesAfter:X.length,numLines:Y}}function V1(D){return D==... L9: `).map((F,G,q)=>{let W=J?J(F,G):F;return G===0?`${X}${W}`:G===q.length-1?`${Y}${W}`:`${Q}${W}`}).join(` ... L14: `).slice(J);this.output.wr

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4534367 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4534367 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg

Source & flagged code

11 flagged

dist/src/sdk.jsView file

430patternName = private_key_rsa severity = critical line = 430 matchedText = `||J==="...thm.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/sdk.jsView on unpkg · L430

430patternName = private_key_rsa severity = critical line = 430 matchedText = `||J==="...thm.

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L430

439patternName = private_key_rsa severity = critical line = 439 matchedText = `+" - T...in(`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L439

628patternName = private_key_rsa severity = critical line = 628 matchedText = All pack... J=`

Critical

Secret Pattern

RSA private key in dist/src/sdk.js

dist/src/sdk.jsView on unpkg · L628

259L260: see https://github.com/jprichardson/node-fs-extra/issues/269`);eF.checkPaths(D,Z,"copy",(Y,J)=>{if(Y)return X(Y);let{srcStat:$,destStat:F}=J;eF.checkParentPaths(D,$,Z,"copy",(G)=>{... L261: `)}ke.check=Gc0;async function qc0(D){var Z;if((Z=D.app.extConfig.server)===null||Z===void 0?void 0:Z.url)return null;if(["",".","..","../","./"].includes(D.app.webDir))return`"${D...

High

Child Process

Package source references child process execution.

dist/src/sdk.jsView on unpkg · L259

119L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Y}=await BF.checkPaths(D,Z,"copy",Q);if(await BF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Y}=EF.checkPathsSync(D,Z,"copy",Q);if(EF.checkParentPathsSync(D,... L123: `,finalEOL:Q=!0,replacer:X=null,spaces:Y}={}){let J=Q?Z:"",$=JSON.stringify(D,X,Y);if($===void 0)throw TypeError(`Converting ${typeof D} value to JSON is not supported`);return $.r... L124: `)];for(let[q,W]of G.entries()){if(X+=W,CH.has(W)){let{groups:U}=new RegExp("(?:\\[(?<code>\\d+)m|\\]8;;(?<uri>.*)\x07)").exec(G.slice(q).join(""))||{groups:{}};if(U.code!==void 0)... ... L132: `);return H=Math

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sdk.jsView on unpkg · L119

117`)}function nj0(D){if(D)process.env.DEBUG=D;else delete process.env.DEBUG}function ij0(){return process.env.DEBUG}function oj0(D){D.inspectOpts={};let Z=Object.keys(wu.inspectOpts)... L118: `).map((Z)=>Z.trim()).join(" ")};Nu.O=function(D){return this.inspectOpts.colors=this.useColors,VH.inspect(D,this.inspectOpts)}});var OH=A((ZL1,yN)=>{if(typeof process>"u"||process... L119: L120: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:X,destStat:Y}=await BF.checkPaths(D,Z,"copy",Q);if(await BF.checkParentPath... L121: L122: see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:X,destStat:Y}=EF.checkPathsSync(D,Z,"copy",Q);if(EF.checkParentPathsSync(D,... L123: `,finalEOL:Q=!0,repl

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/sdk.jsView on unpkg · L117

94${N}`}});var v_=A((k_)=>{Object.defineProperty(k_,"__esModule",{value:!0});k_.WebAuthnUnknownError=k_.WebAuthnError=void 0;k_.isWebAuthnError=SL0;k_.identifyRegistrationError=xL0;k... L95: `);let w=await K.signMessage(new TextEncoder().encode(V),"utf8");if(!w||!(w instanceof Uint8Array))throw Error("@supabase/auth-js: Wallet signMessage() API returned an recognized v... L96: `)!=-1,X=this._styles,Y=X.length;while(Y--){var J=w5[X[Y]];if(Z=J.open+Z.replace(J.closeRe,J.open)+J.close,Q)Z=Z.replace(xw0,function($){return J.close+$+J.open})}return Z}L1.setTh...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/sdk.jsView on unpkg · L94

4`){if(J)X+=hI("");let V=Y?fI(Y):void 0;if(Y&&V)X+=vI(V)}else if(U===` L5: `){if(Y&&fI(Y))X+=vI(Y);if(J)X+=hI(J)}}return X},xU0;var eK=o(()=>{rK();tK=`${IU0}8;;`,kI=new RegExp(`(?:\\${bI}(?<code>\\d+)m|\\${tK}(?<uri>.*)${aK})`,"y"),xU0=/\r?\n/});var KD=A(... L6: `),J=0,$=D;for(let G of Y){if($<=G.length)break;$-=G.length+1,J++}for(J=Math.max(0,Math.min(Y.length-1,J+Q)),$=Math.min($,Y[J].length)+Z;$<0&&J>0;)J--,$+=Y[J].length+1;for(;$>Y[J].... L7: `),X=Z.split(` L8: `),Y=Math.max(Q.length,X.length),J=[];for(let $=0;$<Y;$++)Q[$]!==X[$]&&J.push($);return{lines:J,numLinesBefore:Q.length,numLinesAfter:X.length,numLines:Y}}function V1(D){return D==... L9: `).map((F,G,q)=>{let W=J?J(F,G):F;return G===0?`${X}${W}`:G===q.length-1?`${Y}${W}`:`${Q}${W}`}).join(` ... L14: `).slice(J);this.output.wr

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/src/sdk.jsView on unpkg · L4

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4534367 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4534367 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg