@checksum-ai/runtime@5.3.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@checksum-ai/runtime@5.3.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Package contains a possible secret pattern.

checksum-root/checksum.config.tsView on unpkg · L44

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

index.jsView file

1"use strict";var JK=Object.create;var Du=Object.defineProperty;var GK=Object.getOwnPropertyDescriptor;var qK=Object.getOwnPropertyNames;var VK=Object.getPrototypeOf,YK=Object.proto... L2: `);let s;for(;(s=i5.exec(l))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let h=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),h==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}u(r5,"parse");function c5(a){a=a||{};let o=JR(a);a.path=o;let l=dt.configDotenv(a);if(!l.parsed){let h=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(y2,"isValidHeaderValue");function EZ(a){let o=(a.headersList.get("referrer-policy",!0)??"").split(","),l="";if(o.length)for(let s=o.l... ... L45: L46: ${o.format(l)}`.trim())}};k3.exports=dO});var gO=b((cxe,x3)=>{

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

1"use strict";var JK=Object.create;var Du=Object.defineProperty;var GK=Object.getOwnPropertyDescriptor;var qK=Object.getOwnPropertyNames;var VK=Object.getPrototypeOf,YK=Object.proto... L2: `);let s;for(;(s=i5.exec(l))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let h=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),h==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}u(r5,"parse");function c5(a){a=a||{};let o=JR(a);a.path=o;let l=dt.configDotenv(a);if(!l.parsed){let h=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(y2,"isValidHeaderValue");function EZ(a){let o=(a.headersList.get("referrer-policy",!0)??"").split(","),l="";if(o.length)for(let s=o.l... ... L45: L46: ${o.format(l)}`.trim())}};k3.exports=dO});var gO=b((cxe,x3)=>{

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

index.jsView on unpkg · L1

cli.jsView file

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var sX=Object.create;var xs=Object.defineProperty;var fX=Object.getOwnPropertyDescriptor;var dX=Object.getOwnPropertyNames;var pX=Object.getPrototypeOf,gX=Object.proto... L2: `);let s;for(;(s=wX.exec(l))!=null;){let i=s[1],f=s[2]||"";f=f.trim();let g=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),g==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[i]=f}return o}u(SX,"parse");function kX(a){a=a||{};let o=M_(a);a.path=o;let l=Ct.configDotenv(a);if(!l.parsed){let g=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(sF,"isValidHeaderValue");function jne(a){let o=(a.headersList.get("referrer-policy",!0)??

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg