@cevek/screentest: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@cevek/screentest: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/global-setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cevek/screentest@0.4.0 matchedIdentity = npm:QGNldmVrL3NjcmVlbnRlc3Q:0.4.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/global-setup.jsView on unpkg

7// src/runner/global-setup.ts L8: import { spawn as spawn2 } from "child_process"; L9: import { promises as fs2 } from "fs";

High

Child Process

Package source references child process execution.

dist/global-setup.jsView on unpkg · L7

7Cross-file remote execution chain: dist/global-setup.js spawns dist/index.js; helper contains network access plus dynamic code execution. L7: // src/runner/global-setup.ts L8: import { spawn as spawn2 } from "child_process"; L9: import { promises as fs2 } from "fs"; ... L15: import { existsSync } from "fs"; L16: import { request } from "http"; L17: import { dirname, resolve } from "path"; ... L40: if (ps.error) return { state: "no-docker", reason: ps.error.message }; L41: if (ps.status !== 0) return { state: "no-docker", reason: ps.stderr.trim() }; L42: const [status = "", image = ""] = ps.stdout.trim().split(" "); ... L65: const templates = resolveTemplatesDir(); L66: process.stderr.write(`Building Docker image ${FULL_IMAGE} (~2 min first time, cached after). L67: `);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-setup.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-setup.jsView on unpkg

dist/index.jsView file

15535} L15536: process.stdout.write( L15537: ` ... L15539: 1. screentest serve # one-time: starts the shared Firefox daemon L15540: 2. APP_URL=http://localhost:<port> \\ L15541: npx vitest run --config vitest.screentest.config.ts ... L15550: // src/daemon.ts L15551: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15552: import { existsSync as existsSync4 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15535

15535Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L15535: } L15536: process.stdout.write( L15537: ` ... L15539: 1. screentest serve # one-time: starts the shared Firefox daemon L15540: 2. APP_URL=http://localhost:<port> \\ L15541: npx vitest run --config vitest.screentest.config.ts ... L15550: // src/daemon.ts L15551: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15552: import { existsSync as existsSync4 } from "fs";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L15535

•matchType = normalized_sha256 matchedPackage = @cevek/screentest@0.3.6 matchedPath = dist/index.js matchedIdentity = npm:QGNldmVrL3NjcmVlbnRlc3Q:0.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source & flagged code

7 flagged

dist/global-setup.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cevek/screentest@0.4.0 matchedIdentity = npm:QGNldmVrL3NjcmVlbnRlc3Q:0.4.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/global-setup.jsView on unpkg

7// src/runner/global-setup.ts L8: import { spawn as spawn2 } from "child_process"; L9: import { promises as fs2 } from "fs";

High

Child Process

Package source references child process execution.

dist/global-setup.jsView on unpkg · L7

7Cross-file remote execution chain: dist/global-setup.js spawns dist/index.js; helper contains network access plus dynamic code execution. L7: // src/runner/global-setup.ts L8: import { spawn as spawn2 } from "child_process"; L9: import { promises as fs2 } from "fs"; ... L15: import { existsSync } from "fs"; L16: import { request } from "http"; L17: import { dirname, resolve } from "path"; ... L40: if (ps.error) return { state: "no-docker", reason: ps.error.message }; L41: if (ps.status !== 0) return { state: "no-docker", reason: ps.stderr.trim() }; L42: const [status = "", image = ""] = ps.stdout.trim().split(" "); ... L65: const templates = resolveTemplatesDir(); L66: process.stderr.write(`Building Docker image ${FULL_IMAGE} (~2 min first time, cached after). L67: `);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/global-setup.jsView on unpkg · L7

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/global-setup.jsView on unpkg

dist/index.jsView file

15535} L15536: process.stdout.write( L15537: ` ... L15539: 1. screentest serve # one-time: starts the shared Firefox daemon L15540: 2. APP_URL=http://localhost:<port> \\ L15541: npx vitest run --config vitest.screentest.config.ts ... L15550: // src/daemon.ts L15551: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15552: import { existsSync as existsSync4 } from "fs";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L15535

15535Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L15535: } L15536: process.stdout.write( L15537: ` ... L15539: 1. screentest serve # one-time: starts the shared Firefox daemon L15540: 2. APP_URL=http://localhost:<port> \\ L15541: npx vitest run --config vitest.screentest.config.ts ... L15550: // src/daemon.ts L15551: import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process"; L15552: import { existsSync as existsSync4 } from "fs";

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L15535

•matchType = normalized_sha256 matchedPackage = @cevek/screentest@0.3.6 matchedPath = dist/index.js matchedIdentity = npm:QGNldmVrL3NjcmVlbnRlc3Q:0.3.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity