@caplets/core@0.36.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@caplets/core@0.36.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @caplets/core@0.35.0 matchedIdentity = npm:QGNhcGxldHMvY29yZQ:0.35.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

18import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path"; L19: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L20: import process$1, { stdin, stdout } from "node:process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L18

4211if (process$1.versions?.electron) parseOptions.from = "electron"; L4212: const execArgv = process$1.execArgv ?? []; L4213: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L4211

18Cross-file remote execution chain: dist/index.js spawns dist/schemas-O9uV4ZjU.js; helper contains network access plus dynamic code execution. L18: import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path"; L19: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L20: import process$1, { stdin, stdout } from "node:process"; L21: import { Readable, Writable } from "node:stream"; L22: import { STATUS_CODES, createServer } from "node:http"; L23: import { arch, homedir, platform, tmpdir, userInfo } from "node:os"; ... L181: else if (format === "cidr-v6") stringSchema = stringSchema.check(z.cidrv6()); L182: else if (format === "base64") stringSchema = stringSchema.check(z.base64()); L183: e

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L18

18Detached bundled service listener: dist/index.js launches a Node helper and exposes a broad-bound HTTP listener. L18: import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path"; L19: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L20: import process$1, { stdin, stdout } from "node:process"; L21: import { Readable, Writable } from "node:stream"; L22: import { STATUS_CODES, createServer } from "node:http"; L23: import { arch, homedir, platform, tmpdir, userInfo } from "node:os"; ... L181: else if (format === "cidr-v6") stringSchema = stringSchema.check(z.cidrv6()); L182: else if (format === "base64") stringSchema = stringSchema.check(z.base64()); L183: else if (format === "base64url

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/index.jsView on unpkg · L18

21524patternName = generic_password severity = medium line = 21524 matchedText = password...ed]"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L21524

2629* https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L2630: * @typedef { import("./argument.js").Argument } Argument L2631: * @typedef { import("./command.js").Command } Command

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2629

dist/completion-DqhaGqM9.jsView file

4133try { L4134: const utilInspect = eval("require('util').inspect"); L4135: _custom = utilInspect.custom;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/completion-DqhaGqM9.jsView on unpkg · L4133

dist/user-settings-DIEguofv.jsView file

•path = dist/user-settings-DIEguofv.js kind = oversized_source_file sizeBytes = 4830427 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/user-settings-DIEguofv.jsView on unpkg

Source & flagged code

9 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @caplets/core@0.35.0 matchedIdentity = npm:QGNhcGxldHMvY29yZQ:0.35.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

18import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path"; L19: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L20: import process$1, { stdin, stdout } from "node:process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L18

4211if (process$1.versions?.electron) parseOptions.from = "electron"; L4212: const execArgv = process$1.execArgv ?? []; L4213: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) parseOptions.from = "eval";

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L4211

18Cross-file remote execution chain: dist/index.js spawns dist/schemas-O9uV4ZjU.js; helper contains network access plus dynamic code execution. L18: import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path"; L19: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L20: import process$1, { stdin, stdout } from "node:process"; L21: import { Readable, Writable } from "node:stream"; L22: import { STATUS_CODES, createServer } from "node:http"; L23: import { arch, homedir, platform, tmpdir, userInfo } from "node:os"; ... L181: else if (format === "cidr-v6") stringSchema = stringSchema.check(z.cidrv6()); L182: else if (format === "base64") stringSchema = stringSchema.check(z.base64()); L183: e

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L18

18Detached bundled service listener: dist/index.js launches a Node helper and exposes a broad-bound HTTP listener. L18: import path, { basename, dirname, extname, isAbsolute, join, normalize, parse, posix, relative, resolve, sep, win32 } from "node:path"; L19: import childProcess, { execFile, execFileSync, spawn } from "node:child_process"; L20: import process$1, { stdin, stdout } from "node:process"; L21: import { Readable, Writable } from "node:stream"; L22: import { STATUS_CODES, createServer } from "node:http"; L23: import { arch, homedir, platform, tmpdir, userInfo } from "node:os"; ... L181: else if (format === "cidr-v6") stringSchema = stringSchema.check(z.cidrv6()); L182: else if (format === "base64") stringSchema = stringSchema.check(z.base64()); L183: else if (format === "base64url

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/index.jsView on unpkg · L18

21524patternName = generic_password severity = medium line = 21524 matchedText = password...ed]"

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L21524

2629* https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html#import-types L2630: * @typedef { import("./argument.js").Argument } Argument L2631: * @typedef { import("./command.js").Command } Command

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L2629

dist/completion-DqhaGqM9.jsView file

Lines 4113-4153javascript

4113 const INLINE_LIST = Symbol("inline-list");

4114 function InlineList(type) {

4115 return Object.defineProperties([], {

4116

dist/user-settings-DIEguofv.jsView file

•path = dist/user-settings-DIEguofv.js kind = oversized_source_file sizeBytes = 4830427 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/user-settings-DIEguofv.jsView on unpkg