@checksum-ai/runtime@4.18.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@checksum-ai/runtime@4.18.1: Suspicious npm security report | LPM Firewall

Source & flagged code

13 flagged · loading source

1patternName = blocked_file severity = critical blockedFile = .env redactedSecretContext = secretLikeLines = 1 L1: CHECKSUM_RUNTIME_BUILD_TIME=<redacted:24 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

index.jsView file

129) L130: `)}close(){this.#n.close()}get(o){NO(o);let l=this.#d(o);return l?{body:l.body?Buffer.from(l.body.buffer,l.body.byteOffset,l.body.byteLength):void 0,statusCode:l.statusCode,statusM... L131: ${h}`;return}if(Wg(o,r,Ase)){yse(o,f)&&(l.retry=o.toString("utf8",f));return}if(Wg(o,r,hse)){vse(o,f)&&(l.id=o.toString("utf8",f));return}if(Wg(o,r,gse)){let h=o.toString("utf8",f)... ... L133: `);a.stack=l?`${l} L134: ${f}`:r.stack}u(v4,"appendFetchStackTrace");U.exports.fetch=u(function(o,l=void 0){return Kse(o,l).catch(s=>{throw g4?v4(s,g4):s&&typeof s=="object"&&Error.captureStackTrace(s,U.ex... L135: `);return I.substr(0,I.length-2)},this.getRequestHeader=function(I){return typeof I=="string"&&n[I]?n[I]:""},this.send=function(I){if(this.readyState!=this.OPENED)throw new Error("...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L129

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. index.js: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}u(DK,"parse");function RK(a){a=a||{};let o=DR(a);a.path=o;let l=dt.configDotenv(a);if(!l.parsed){let h=new Error(`MISSING_DATA: Cannot ... `)||a.includes("\r")||a.includes("\0"))===!1}u(r2,"isValidHeaderValue");function Y9(a){let o=(a.headersList.get("referrer-policy",!0)??"").split(","),l="";if(o.length)for(let s=o.l... `,this[zX]=p??3e5,this[YX]=s??3e5,this[$X]=v??!0,this[xE]=k,this[Mi]=null,this[tee]=_>-1?_:-1,this[Ge]=null,this[iee]={pingInterval:M?.pingInterval??m??6e4,connectionWindowSize:M?.... ${o.format(l)}`.trim())}};h3.exports=cO});var lO=b((c0e,b3)=>{"use strict";var{In

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

index.jsView on unpkg

scripts/playwright_patches/1.52.0.jsView file

249// reported: false, L250: // userData: undefined, L251: // stepId: undefined ... L323: L324: const isRuntime = true || process.env.RUNTIME === "true"; L325:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/playwright_patches/1.52.0.jsView on unpkg · L249

cli.jsView file

129) L130: `)}close(){this.#n.close()}get(o){Dw(o);let l=this.#d(o);return l?{body:l.body?Buffer.from(l.body.buffer,l.body.byteOffset,l.body.byteLength):void 0,statusCode:l.statusCode,statusM... L131: ${g}`;return}if(aA(o,i,Phe)){Bhe(o,f)&&(l.retry=o.toString("utf8",f));return}if(aA(o,i,The)){xhe(o,f)&&(l.id=o.toString("utf8",f));return}if(aA(o,i,khe)){let g=o.toString("utf8",f)... ... L133: `);a.stack=l?`${l} L134: ${f}`:i.stack}u(lJ,"appendFetchStackTrace");G.exports.fetch=u(function(o,l=void 0){return sAe(o,l).catch(s=>{throw iJ?lJ(s,iJ):s&&typeof s=="object"&&Error.captureStackTrace(s,G.ex... L135: `);return b.substr(0,b.length-2)},this.getRequestHeader=function(b){return typeof b=="string"&&n[b]?n[b]:""},this.send=function(b){if(this.readyState!=this.OPENED)throw new Error("... L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L129

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var B7=Object.create;var Bs=Object.defineProperty;var x7=Object.getOwnPropertyDescriptor;var R7=Object.getOwnPropertyNames;var D7=Object.getPrototypeOf,N7=Object.proto... L2: `);let s;for(;(s=G7.exec(l))!=null;){let i=s[1],f=s[2]||"";f=f.trim();let g=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),g==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[i]=f}return o}u(q7,"parse");function V7(a){a=a||{};let o=C_(a);a.path=o;let l=Ct.configDotenv(a);if(!l.parsed){let g=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(Y2,"isValidHeaderValue");function cne(a){let o=(a.headersList.get("referrer-policy",!0)??

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Hardcoded password in checksum-root/checksum.config.ts

checksum-root/checksum.config.tsView on unpkg · L44

Source & flagged code

13 flagged

Lines 1-1text

1CHECKSUM_RUNTIME_BUILD_TIME=2026-09-08T14:06:48.594Z

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L1

postinstall.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const { exec } = require("child_process");

4

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

5try {

6 console.log("Adding checksum scripts to package.json");

7 const packageJsonPath = path.resolve(__dirname, "../../../package.json");

8 if (!fs.existsSync(packageJsonPath)) {

9 console.log("No package.json found, will not add checksum script");

10 process.exit(1);

11 }

12 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath));

13

14 // verify that the package.json has a scripts section

15 if (!packageJson.scripts) {

16 packageJson.scripts = {};

17 }

18

19 packageJson.scripts["checksum"] =

20 "node ./node_modules/@checksum-ai/runtime/cli.js";

21

22 fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

index.jsView file

129) L130: `)}close(){this.#n.close()}get(o){NO(o);let l=this.#d(o);return l?{body:l.body?Buffer.from(l.body.buffer,l.body.byteOffset,l.body.byteLength):void 0,statusCode:l.statusCode,statusM... L131: ${h}`;return}if(Wg(o,r,Ase)){yse(o,f)&&(l.retry=o.toString("utf8",f));return}if(Wg(o,r,hse)){vse(o,f)&&(l.id=o.toString("utf8",f));return}if(Wg(o,r,gse)){let h=o.toString("utf8",f)... ... L133: `);a.stack=l?`${l} L134: ${f}`:r.stack}u(v4,"appendFetchStackTrace");U.exports.fetch=u(function(o,l=void 0){return Kse(o,l).catch(s=>{throw g4?v4(s,g4):s&&typeof s=="object"&&Error.captureStackTrace(s,U.ex... L135: `);return I.substr(0,I.length-2)},this.getRequestHeader=function(I){return typeof I=="string"&&n[I]?n[I]:""},this.send=function(I){if(this.readyState!=this.OPENED)throw new Error("...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L129

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. index.js: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}u(DK,"parse");function RK(a){a=a||{};let o=DR(a);a.path=o;let l=dt.configDotenv(a);if(!l.parsed){let h=new Error(`MISSING_DATA: Cannot ... `)||a.includes("\r")||a.includes("\0"))===!1}u(r2,"isValidHeaderValue");function Y9(a){let o=(a.headersList.get("referrer-policy",!0)??"").split(","),l="";if(o.length)for(let s=o.l... `,this[zX]=p??3e5,this[YX]=s??3e5,this[$X]=v??!0,this[xE]=k,this[Mi]=null,this[tee]=_>-1?_:-1,this[Ge]=null,this[iee]={pingInterval:M?.pingInterval??m??6e4,connectionWindowSize:M?.... ${o.format(l)}`.trim())}};h3.exports=cO});var lO=b((c0e,b3)=>{"use strict";var{In

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

index.jsView on unpkg

scripts/playwright_patches/1.52.0.jsView file

Lines 229-269javascript

229 projectRoot,

230 "node_modules/playwright-core/lib/client/channelOwner.js"

231 );

232 if (!doesFileExist(file)) {

233 return;

234 }

235 let originalContent, newContent;

cli.jsView file

129) L130: `)}close(){this.#n.close()}get(o){Dw(o);let l=this.#d(o);return l?{body:l.body?Buffer.from(l.body.buffer,l.body.byteOffset,l.body.byteLength):void 0,statusCode:l.statusCode,statusM... L131: ${g}`;return}if(aA(o,i,Phe)){Bhe(o,f)&&(l.retry=o.toString("utf8",f));return}if(aA(o,i,The)){xhe(o,f)&&(l.id=o.toString("utf8",f));return}if(aA(o,i,khe)){let g=o.toString("utf8",f)... ... L133: `);a.stack=l?`${l} L134: ${f}`:i.stack}u(lJ,"appendFetchStackTrace");G.exports.fetch=u(function(o,l=void 0){return sAe(o,l).catch(s=>{throw iJ?lJ(s,iJ):s&&typeof s=="object"&&Error.captureStackTrace(s,G.ex... L135: `);return b.substr(0,b.length-2)},this.getRequestHeader=function(b){return typeof b=="string"&&n[b]?n[b]:""},this.send=function(b){if(this.readyState!=this.OPENED)throw new Error("... L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L129

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var B7=Object.create;var Bs=Object.defineProperty;var x7=Object.getOwnPropertyDescriptor;var R7=Object.getOwnPropertyNames;var D7=Object.getPrototypeOf,N7=Object.proto... L2: `);let s;for(;(s=G7.exec(l))!=null;){let i=s[1],f=s[2]||"";f=f.trim();let g=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),g==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[i]=f}return o}u(q7,"parse");function V7(a){a=a||{};let o=C_(a);a.path=o;let l=Ct.configDotenv(a);if(!l.parsed){let g=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(Y2,"isValidHeaderValue");function cne(a){let o=(a.headersList.get("referrer-policy",!0)??

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Hardcoded password in checksum-root/checksum.config.ts

checksum-root/checksum.config.tsView on unpkg · L44