@checksum-ai/runtime@4.17.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@checksum-ai/runtime@4.17.0: Malicious npm security report | LPM Firewall

Source & flagged code

17 flagged · loading source

1patternName = blocked_file severity = critical blockedFile = .env redactedSecretContext = secretLikeLines = 1 L1: CHECKSUM_RUNTIME_BUILD_TIME=<redacted:24 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

index.jsView file

1"use strict";var Are=Object.create;var yd=Object.defineProperty;var yre=Object.getOwnPropertyDescriptor;var vre=Object.getOwnPropertyNames;var bre=Object.getPrototypeOf,mre=Object.... L2: `);let s;for(;(s=Ade.exec(c))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let p=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),p==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),n[r]=f}return n}u(yde,"parse");function vde(i){i=i||{};let n=rH(i);i.path=n;let c=Qt.configDotenv(i);if(!c.parsed){let p=new Error(`MISSING_DATA: Canno... L4: `).join(` ... L28: If your bundler has issues with dynamic imports take a look at '.plugins.setDependencyResolution()'. L29: `;throw console.warn(a),new Error("Plugin dependency not found")},"requireDependencyOrDie"),c=new Set(this.names),s=u(({name:r,dependen

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

155Trigger-reachable chain: manifest.main -> index.js L155: ) L156: `)}close(){this.#n.close()}get(n){XB(n);let c=this.#d(n);return c?{body:c.body?Buffer.from(c.body.buffer,c.body.byteOffset,c.body.byteLength):void 0,statusCode:c.statusCode,statusM... L157: ${p}`;return}if(ym(n,r,YTe)){KTe(n,f)&&(c.retry=n.toString("utf8",f));return}if(ym(n,r,zTe)){ZTe(n,f)&&(c.id=n.toString("utf8",f));return}if(ym(n,r,VTe)){let p=n.toString("utf8",f)... ... L159: `);i.stack=c?`${c} L160: ${f}`:r.stack}u(v9,"appendFetchStackTrace");K.exports.fetch=u(function(n,c=void 0){return _0e(n,c).catch(s=>{throw h9?v9(s,h9):s&&typeof s=="object"&&Error.captureStackTrace(s,K.ex... L161: `);return m.substr(0,m.length-2)},this.getRequestHeader=function(m){return typeof m=="string"&&o[m]?o[m]:""},this.send=function(m){if(th

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L155

checksum-progress-reporter.jsView file

•Remote response is passed to a worker and executed with Node capabilities. checksum-progress-reporter.js: "use strict";var id=Object.create;var xr=Object.defineProperty;var ad=Object.getOwnPropertyDescriptor;var sd=Object.getOwnPropertyNames;var od=Object.getPrototypeOf,ld=Object.proto... `),a=a.replace(/\\r/g,"\r")),e[i]=a}return e}s(Cg,"parse");function kg(t){t=t||{};let e=ju(t);t.path=e;let r=ne.configDotenv(t);if(!r.parsed){let o=new Error(`MISSING_DATA: Cannot ... `)}s(kd,"convertToPrettyString");var hi=Symbol.for("langchain.message");function Od(t,e){function r(n,i){if(typeof n!="object"||n===null||n===void 0)return n;if(i>=e)return Array.i... Please make sure you are calling this method within a traceable function and that tracing is enabled.`);return e}s(Zi,"getCurrentRunTree");var

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

checksum-progress-reporter.jsView on unpkg

cli.jsView file

1Cross-file remote execution chain: cli.js spawns checksum-progress-reporter.js; helper contains network access plus dynamic code execution. L1: "use strict";var wle=Object.create;var Ap=Object.defineProperty;var Ole=Object.getOwnPropertyDescriptor;var Sle=Object.getOwnPropertyNames;var Cle=Object.getPrototypeOf,kle=Object.... L2: `);let l;for(;(l=Oye.exec(a))!=null;){let i=l[1],f=l[2]||"";f=f.trim();let d=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),d==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),n[i]=f}return n}u(Sye,"parse");function Cye(r){r=r||{};let n=V$(r);r.path=n;let a=zt.configDotenv(r);if(!a.parsed){let d=new Error(`MISSING_DATA: Canno... L4: `).join(` ... L28: If your bundler has issues with dynamic imports take a look at '.plugins.setDependencyResolution()'.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

test-run-monitor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @checksum-ai/runtime@5.3.0 matchedIdentity = npm:QGNoZWNrc3VtLWFpL3J1bnRpbWU:5.3.0 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

test-run-monitor.jsView on unpkg

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Hardcoded password in checksum-root/checksum.config.ts

checksum-root/checksum.config.tsView on unpkg · L44

Source & flagged code

17 flagged

Lines 1-1text

1CHECKSUM_RUNTIME_BUILD_TIME=2026-08-27T22:49:10.324Z

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const { exec } = require("child_process");

4

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

5try {

6 console.log("Adding checksum scripts to package.json");

7 const packageJsonPath = path.resolve(__dirname, "../../../package.json");

8 if (!fs.existsSync(packageJsonPath)) {

9 console.log("No package.json found, will not add checksum script");

10 process.exit(1);

11 }

12 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath));

13

14 // verify that the package.json has a scripts section

15 if (!packageJson.scripts) {

16 packageJson.scripts = {};

17 }

18

19 packageJson.scripts["checksum"] =

20 "node ./node_modules/@checksum-ai/runtime/cli.js";

21

22 fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

index.jsView file

1"use strict";var Are=Object.create;var yd=Object.defineProperty;var yre=Object.getOwnPropertyDescriptor;var vre=Object.getOwnPropertyNames;var bre=Object.getPrototypeOf,mre=Object.... L2: `);let s;for(;(s=Ade.exec(c))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let p=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),p==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),n[r]=f}return n}u(yde,"parse");function vde(i){i=i||{};let n=rH(i);i.path=n;let c=Qt.configDotenv(i);if(!c.parsed){let p=new Error(`MISSING_DATA: Canno... L4: `).join(` ... L28: If your bundler has issues with dynamic imports take a look at '.plugins.setDependencyResolution()'. L29: `;throw console.warn(a),new Error("Plugin dependency not found")},"requireDependencyOrDie"),c=new Set(this.names),s=u(({name:r,dependen

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

155Trigger-reachable chain: manifest.main -> index.js L155: ) L156: `)}close(){this.#n.close()}get(n){XB(n);let c=this.#d(n);return c?{body:c.body?Buffer.from(c.body.buffer,c.body.byteOffset,c.body.byteLength):void 0,statusCode:c.statusCode,statusM... L157: ${p}`;return}if(ym(n,r,YTe)){KTe(n,f)&&(c.retry=n.toString("utf8",f));return}if(ym(n,r,zTe)){ZTe(n,f)&&(c.id=n.toString("utf8",f));return}if(ym(n,r,VTe)){let p=n.toString("utf8",f)... ... L159: `);i.stack=c?`${c} L160: ${f}`:r.stack}u(v9,"appendFetchStackTrace");K.exports.fetch=u(function(n,c=void 0){return _0e(n,c).catch(s=>{throw h9?v9(s,h9):s&&typeof s=="object"&&Error.captureStackTrace(s,K.ex... L161: `);return m.substr(0,m.length-2)},this.getRequestHeader=function(m){return typeof m=="string"&&o[m]?o[m]:""},this.send=function(m){if(th

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L155

checksum-progress-reporter.jsView file

•Remote response is passed to a worker and executed with Node capabilities. checksum-progress-reporter.js: "use strict";var id=Object.create;var xr=Object.defineProperty;var ad=Object.getOwnPropertyDescriptor;var sd=Object.getOwnPropertyNames;var od=Object.getPrototypeOf,ld=Object.proto... `),a=a.replace(/\\r/g,"\r")),e[i]=a}return e}s(Cg,"parse");function kg(t){t=t||{};let e=ju(t);t.path=e;let r=ne.configDotenv(t);if(!r.parsed){let o=new Error(`MISSING_DATA: Cannot ... `)}s(kd,"convertToPrettyString");var hi=Symbol.for("langchain.message");function Od(t,e){function r(n,i){if(typeof n!="object"||n===null||n===void 0)return n;if(i>=e)return Array.i... Please make sure you are calling this method within a traceable function and that tracing is enabled.`);return e}s(Zi,"getCurrentRunTree");var

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

checksum-progress-reporter.jsView on unpkg

cli.jsView file

1Cross-file remote execution chain: cli.js spawns checksum-progress-reporter.js; helper contains network access plus dynamic code execution. L1: "use strict";var wle=Object.create;var Ap=Object.defineProperty;var Ole=Object.getOwnPropertyDescriptor;var Sle=Object.getOwnPropertyNames;var Cle=Object.getPrototypeOf,kle=Object.... L2: `);let l;for(;(l=Oye.exec(a))!=null;){let i=l[1],f=l[2]||"";f=f.trim();let d=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),d==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),n[i]=f}return n}u(Sye,"parse");function Cye(r){r=r||{};let n=V$(r);r.path=n;let a=zt.configDotenv(r);if(!a.parsed){let d=new Error(`MISSING_DATA: Canno... L4: `).join(` ... L28: If your bundler has issues with dynamic imports take a look at '.plugins.setDependencyResolution()'.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

test-run-monitor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @checksum-ai/runtime@5.3.0 matchedIdentity = npm:QGNoZWNrc3VtLWFpL3J1bnRpbWU:5.3.0 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

test-run-monitor.jsView on unpkg

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Hardcoded password in checksum-root/checksum.config.ts

checksum-root/checksum.config.tsView on unpkg · L44