@checksum-ai/runtime@5.5.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@checksum-ai/runtime@5.5.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

checksum-root/checksum.config.tsView file

44patternName = generic_password severity = medium line = 44

Medium

Secret Pattern

Package contains a possible secret pattern.

checksum-root/checksum.config.tsView on unpkg · L44

postinstall.jsView file

2const path = require("path"); L3: const { exec } = require("child_process"); L4:

High

Child Process

Package source references child process execution.

postinstall.jsView on unpkg · L2

30return new Promise((resolve, reject) => { L31: exec("npx playwright install", (error, stdout, stderr) => { L32: if (error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

postinstall.jsView on unpkg · L30

1const fs = require("fs"); L2: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

index.jsView file

1"use strict";var YS=Object.create;var Ko=Object.defineProperty;var KS=Object.getOwnPropertyDescriptor;var ZS=Object.getOwnPropertyNames;var XS=Object.getPrototypeOf,QS=Object.proto... L2: `);let f;for(;(f=cw.exec(a))!=null;){let r=f[1],p=f[2]||"";p=p.trim();let y=p[0];p=p.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),y==='"'&&(p=p.replace(/\\n/g,` L3: `),p=p.replace(/\\r/g,"\r")),l[r]=p}return l}c(lw,"parse");function uw(u){u=u||{};let l=Yy(u);u.path=l;let a=he.configDotenv(u);if(!a.parsed){let y=new Error(`MISSING_DATA: Cannot ... L4: `);return w.substr(0,w.length-2)},this.getRequestHeader=function(w){return typeof w=="string"&&n[w]?n[w]:""},this.send=function(w){if(this.readyState!=this.OPENED)throw new Error("... L5: `).join(` ... L13: \r L14: `+a)}c(mr,"abortHandshake");function En(u,l,a,

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: "use strict";var YS=Object.create;var Ko=Object.defineProperty;var KS=Object.getOwnPropertyDescriptor;var ZS=Object.getOwnPropertyNames;var XS=Object.getPrototypeOf,QS=Object.proto... L2: `);let f;for(;(f=cw.exec(a))!=null;){let r=f[1],p=f[2]||"";p=p.trim();let y=p[0];p=p.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),y==='"'&&(p=p.replace(/\\n/g,` L3: `),p=p.replace(/\\r/g,"\r")),l[r]=p}return l}c(lw,"parse");function uw(u){u=u||{};let l=Yy(u);u.path=l;let a=he.configDotenv(u);if(!a.parsed){let y=new Error(`MISSING_DATA: Cannot ... L4: `);return w.substr(0,w.length-2)},this.getRequestHeader=function(w){return typeof w=="string"&&n[w]?n[w]:""},this.send=function(w){if(this.readyState!=this.OPENED)throw new Error("...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @checksum-ai/runtime@5.4.3 matchedIdentity = npm:QGNoZWNrc3VtLWFpL3J1bnRpbWU:5.4.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var iE=Object.create;var Hc=Object.defineProperty;var rE=Object.getOwnPropertyDescriptor;var cE=Object.getOwnPropertyNames;var lE=Object.getPrototypeOf,aE=Object.proto... L2: `);let s;for(;(s=vE.exec(u))!=null;){let r=s[1],p=s[2]||"";p=p.trim();let y=p[0];p=p.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),y==='"'&&(p=p.replace(/\\n/g,` L3: `),p=p.replace(/\\r/g,"\r")),c[r]=p}return c}l(bE,"parse");function mE(a){a=a||{};let c=Bm(a);a.path=c;let u=_e.configDotenv(a);if(!u.parsed){let y=new Error(`MISSING_DATA: Cannot ... L4: `);return m.substr(0,m.length-2)},this.getRequestHeader=function(m){return typeof m=="string"&&n[m]?n[m]:""},this.send=function(m){if(th

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg

Source & flagged code

15 flagged

checksum-root/checksum.config.tsView file

Lines 24-64typescript

24 * You can find it in https://app.checksum.ai/#/settings/

25 */

26 apiKey: process.env.CHECKSUM_API_KEY,

27

28 /**

29 * Define your test run environments and test users within each environment.

30 * The environments must be aligned with those set here:

31 * https://app.checksum.ai/#/settings/

32 */

33 environments: [

34 {

35 name: "<The name of the environment>",

36 // Define BASE_URL in checksum/.env before running your tests.

37 baseURL: process.env.BASE_URL!,

38 loginURL: "<The URL of the login page>",

39 default: true,

40 users: [

41 {

42 role: "<The role of the user, may be undefined in case of single user>",

43 username: "<username>",

44 password: "<password>",

Medium

Secret Pattern

Package contains a possible secret pattern.

checksum-root/checksum.config.tsView on unpkg · L44

45 default: true,

46 },

47 ],

48 },

49 ],

50

51 options: {

52 /**

53 * Recover from failing to locate an element for an action (see README)

54 */

55 useChecksumSelectors: true,

56 /**

57 * Recover from a failed action or assertion (see README)

58 */

59 useChecksumAI: { actions: true, assertions: false },

60 /**

61 * Whether to use mock API data when running your tests (see README)

62 */

63 useMockData: false,

64 /**

postinstall.jsView file

Lines 1-22javascript

1const fs = require("fs");

2const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

postinstall.jsView on unpkg · L1

3const

index.jsView file

1"use strict";var YS=Object.create;var Ko=Object.defineProperty;var KS=Object.getOwnPropertyDescriptor;var ZS=Object.getOwnPropertyNames;var XS=Object.getPrototypeOf,QS=Object.proto... L2: `);let f;for(;(f=cw.exec(a))!=null;){let r=f[1],p=f[2]||"";p=p.trim();let y=p[0];p=p.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),y==='"'&&(p=p.replace(/\\n/g,` L3: `),p=p.replace(/\\r/g,"\r")),l[r]=p}return l}c(lw,"parse");function uw(u){u=u||{};let l=Yy(u);u.path=l;let a=he.configDotenv(u);if(!a.parsed){let y=new Error(`MISSING_DATA: Cannot ... L4: `);return w.substr(0,w.length-2)},this.getRequestHeader=function(w){return typeof w=="string"&&n[w]?n[w]:""},this.send=function(w){if(this.readyState!=this.OPENED)throw new Error("... L5: `).join(` ... L13: \r L14: `+a)}c(mr,"abortHandshake");function En(u,l,a,

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: "use strict";var YS=Object.create;var Ko=Object.defineProperty;var KS=Object.getOwnPropertyDescriptor;var ZS=Object.getOwnPropertyNames;var XS=Object.getPrototypeOf,QS=Object.proto... L2: `);let f;for(;(f=cw.exec(a))!=null;){let r=f[1],p=f[2]||"";p=p.trim();let y=p[0];p=p.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),y==='"'&&(p=p.replace(/\\n/g,` L3: `),p=p.replace(/\\r/g,"\r")),l[r]=p}return l}c(lw,"parse");function uw(u){u=u||{};let l=Yy(u);u.path=l;let a=he.configDotenv(u);if(!a.parsed){let y=new Error(`MISSING_DATA: Cannot ... L4: `);return w.substr(0,w.length-2)},this.getRequestHeader=function(w){return typeof w=="string"&&n[w]?n[w]:""},this.send=function(w){if(this.readyState!=this.OPENED)throw new Error("...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @checksum-ai/runtime@5.4.3 matchedIdentity = npm:QGNoZWNrc3VtLWFpL3J1bnRpbWU:5.4.3 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

1Cross-file remote execution chain: cli.js spawns checksumlib.js; helper contains network access plus dynamic code execution. L1: "use strict";var iE=Object.create;var Hc=Object.defineProperty;var rE=Object.getOwnPropertyDescriptor;var cE=Object.getOwnPropertyNames;var lE=Object.getPrototypeOf,aE=Object.proto... L2: `);let s;for(;(s=vE.exec(u))!=null;){let r=s[1],p=s[2]||"";p=p.trim();let y=p[0];p=p.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),y==='"'&&(p=p.replace(/\\n/g,` L3: `),p=p.replace(/\\r/g,"\r")),c[r]=p}return c}l(bE,"parse");function mE(a){a=a||{};let c=Bm(a);a.path=c;let u=_e.configDotenv(a);if(!u.parsed){let y=new Error(`MISSING_DATA: Cannot ... L4: `);return m.substr(0,m.length-2)},this.getRequestHeader=function(m){return typeof m=="string"&&n[m]?n[m]:""},this.send=function(m){if(th

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

cli.jsView on unpkg · L1

checksum-progress-reporter.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

checksum-progress-reporter.js#virtual:normalized:round1View on unpkg