@checksum-ai/runtime@5.4.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@checksum-ai/runtime@5.4.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Package contains a possible secret pattern.

checksum-root/checksum.config.tsView on unpkg · L44

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

index.jsView file

1"use strict";var iW=Object.create;var Ea=Object.defineProperty;var rW=Object.getOwnPropertyDescriptor;var cW=Object.getOwnPropertyNames;var lW=Object.getPrototypeOf,aW=Object.proto... L2: `);let s;for(;(s=vW.exec(u))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let h=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),h==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}a(bW,"parse");function mW(l){l=l||{};let o=eB(l);l.path=o;let u=it.configDotenv(l);if(!u.parsed){let h=new Error(`MISSING_DATA: Cannot ... L4: `)||l.includes("\r")||l.includes("\0"))===!1}a(Tx,"isValidHeaderValue");function Fq(l){let o=(l.headersList.get("referrer-policy",!0)??"").split(","),u="";if(o.length)for(let s=o.l... ... L45: L46: ${o.format(u)}`.trim())}};GQ.exports=vm});var mm=S((Sye,qQ)=>{

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

129Trigger-reachable chain: manifest.main -> index.js L129: ) L130: `)}close(){this.#n.close()}get(o){zm(o);let u=this.#d(o);return u?{body:u.body?Buffer.from(u.body.buffer,u.body.byteOffset,u.body.byteLength):void 0,statusCode:u.statusCode,statusM... L131: ${g}`,this.eventDataSize=p;return}if(Sp(o,r,Ine)){One(o,f)&&(u.retry=o.toString("utf8",f));return}if(Sp(o,r,Ene)){Cne(o,f)&&(u.id=o.toString("utf8",f));return}if(Sp(o,r,mne)){let h... ... L133: `);l.stack=u?`${u} L134: ${f}`:r.stack}a(KF,"appendFetchStackTrace");_.exports.fetch=a(function(o,u=void 0){return aoe(o,u).catch(s=>{throw qF?KF(s,qF):s&&typeof s=="object"&&Error.captureStackTrace(s,_.ex... L135: `);return E.substr(0,E.length-2)},this.getRequestHeader=function(E){return typeof E=="string"&&n[E]?n[E]:""},this.send=function(E){if(th

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L129

cli.jsView file

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var dz=Object.create;var Rd=Object.defineProperty;var pz=Object.getOwnPropertyDescriptor;var gz=Object.getOwnPropertyNames;var hz=Object.getPrototypeOf,Az=Object.proto... L2: `);let s;for(;(s=kz.exec(l))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let h=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),h==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}u(Tz,"parse");function Bz(a){a=a||{};let o=W0(a);a.path=o;let l=At.configDotenv(a);if(!l.parsed){let h=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(AD,"isValidHeaderValue");function V9(a){let o=(a.headersList.get("referrer-policy",!0)??"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg

Source & flagged code

14 flagged

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Package contains a possible secret pattern.

checksum-root/checksum.config.tsView on unpkg · L44

postinstall.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const { exec } = require("child_process");

4

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

5try {

6 console.log("Adding checksum scripts to package.json");

7 const packageJsonPath = path.resolve(__dirname, "../../../package.json");

8 if (!fs.existsSync(packageJsonPath)) {

9 console.log("No package.json found, will not add checksum script");

10 process.exit(1);

11 }

12 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath));

13

14 // verify that the package.json has a scripts section

15 if (!packageJson.scripts) {

16 packageJson.scripts = {};

17 }

18

19 packageJson.scripts["checksum"] =

20 "node ./node_modules/@checksum-ai/runtime/cli.js";

21

22 fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2));

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

index.jsView file

1"use strict";var iW=Object.create;var Ea=Object.defineProperty;var rW=Object.getOwnPropertyDescriptor;var cW=Object.getOwnPropertyNames;var lW=Object.getPrototypeOf,aW=Object.proto... L2: `);let s;for(;(s=vW.exec(u))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let h=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),h==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}a(bW,"parse");function mW(l){l=l||{};let o=eB(l);l.path=o;let u=it.configDotenv(l);if(!u.parsed){let h=new Error(`MISSING_DATA: Cannot ... L4: `)||l.includes("\r")||l.includes("\0"))===!1}a(Tx,"isValidHeaderValue");function Fq(l){let o=(l.headersList.get("referrer-policy",!0)??"").split(","),u="";if(o.length)for(let s=o.l... ... L45: L46: ${o.format(u)}`.trim())}};GQ.exports=vm});var mm=S((Sye,qQ)=>{

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

129Trigger-reachable chain: manifest.main -> index.js L129: ) L130: `)}close(){this.#n.close()}get(o){zm(o);let u=this.#d(o);return u?{body:u.body?Buffer.from(u.body.buffer,u.body.byteOffset,u.body.byteLength):void 0,statusCode:u.statusCode,statusM... L131: ${g}`,this.eventDataSize=p;return}if(Sp(o,r,Ine)){One(o,f)&&(u.retry=o.toString("utf8",f));return}if(Sp(o,r,Ene)){Cne(o,f)&&(u.id=o.toString("utf8",f));return}if(Sp(o,r,mne)){let h... ... L133: `);l.stack=u?`${u} L134: ${f}`:r.stack}a(KF,"appendFetchStackTrace");_.exports.fetch=a(function(o,u=void 0){return aoe(o,u).catch(s=>{throw qF?KF(s,qF):s&&typeof s=="object"&&Error.captureStackTrace(s,_.ex... L135: `);return E.substr(0,E.length-2)},this.getRequestHeader=function(E){return typeof E=="string"&&n[E]?n[E]:""},this.send=function(E){if(th

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L129

cli.jsView file

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var dz=Object.create;var Rd=Object.defineProperty;var pz=Object.getOwnPropertyDescriptor;var gz=Object.getOwnPropertyNames;var hz=Object.getPrototypeOf,Az=Object.proto... L2: `);let s;for(;(s=kz.exec(l))!=null;){let r=s[1],f=s[2]||"";f=f.trim();let h=f[0];f=f.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),h==='"'&&(f=f.replace(/\\n/g,` L3: `),f=f.replace(/\\r/g,"\r")),o[r]=f}return o}u(Tz,"parse");function Bz(a){a=a||{};let o=W0(a);a.path=o;let l=At.configDotenv(a);if(!l.parsed){let h=new Error(`MISSING_DATA: Cannot ... L4: `)||a.includes("\r")||a.includes("\0"))===!1}u(AD,"isValidHeaderValue");function V9(a){let o=(a.headersList.get("referrer-policy",!0)??"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg