@circuitwall/jarela@1.42.3: Manual Review npm security report

Loading npm security reports…

@circuitwall/jarela@1.42.3: Manual Review npm security report | LPM Firewall

Source & flagged code

21 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-hint.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

app/api/v1/update/apply/route.tsView file

19import { join } from "node:path"; L20: import { spawn } from "node:child_process"; L21: import { NextResponse } from "next/server";

High

Child Process

Package source references child process execution.

app/api/v1/update/apply/route.tsView on unpkg · L19

scripts/update.mjsView file

166if (process.platform === "win32") { L167: console.error(`[jarela] (admin PowerShell) npm i -g github:${REPO}#main`); L168: } else {

High

Shell

Package source references shell execution.

scripts/update.mjsView on unpkg · L166

13import { existsSync, readFileSync } from "node:fs"; L14: import { spawnSync } from "node:child_process"; L15: import { join } from "node:path"; ... L18: const REPO = "CircuitWall/jarela"; L19: const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; L20: const GH_COMMIT_URL = `https://api.github.com/repos/${REPO}/commits/main`; ... L24: function resolveChannel() { L25: return (process.env.JARELA_UPDATE_CHANNEL ?? "").trim().toLowerCase() === "main" ? "main" : "stable"; L26: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/update.mjsView on unpkg · L13

•matchType = normalized_sha256 matchedPackage = @circuitwall/jarela@1.41.5 matchedPath = scripts/update.mjs matchedIdentity = npm:QGNpcmN1aXR3YWxsL2phcmVsYQ:1.41.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/update.mjsView on unpkg

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView file

1(()=>{var __webpack_modules__={368:e=>{function BrowserslistError(e){this.name="BrowserslistError";this.message=e;this.browserslist=true;if(Error.captureStackTrace){Error.captureSt...

High

Eval

Package source references dynamic code evaluation.

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView on unpkg · L1

browser-extension/agent-overlay.jsView file

57let applyBrand = null; L58: const brandReady = import(chrome.runtime.getURL("lib/brand.mjs")) L59: .then((m) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

browser-extension/agent-overlay.jsView on unpkg · L57

lib/embeddings/index.tsView file

51L52: const explicitName = process.env.EMBEDDING_MODEL_CONFIG; L53: // 1) explicit embedding model name (if provided). ... L93: function embeddingCacheKey(modelId: string, text: string): string { L94: return `${modelId}\u0000${createHash("sha1").update(text).digest("base64")}`; L95: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/embeddings/index.tsView on unpkg · L51

scripts/service-install.mjsView file

18Trigger-reachable persistence chain: manifest.bin -> scripts/jarela-bin.mjs -> scripts/service-install.mjs L18: L19: import { spawnSync, execFileSync } from "node:child_process"; L20: import { existsSync, mkdirSync, writeFileSync, unlinkSync, rmSync, chmodSync } from "node:fs"; ... L45: for (const k of PROXY_ENV_KEYS) { L46: const v = process.env[k]; L47: if (v && v.length > 0) out[k] = v; ... L59: if (env && env.length > 0) { L60: return env.startsWith("~") ? env.replace(/^~/, homedir()) : env; L61: } ... L93: if (!existsSync(kc)) continue; L94: let stdout; L95: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/service-install.mjsView on unpkg · L18

18L19: import { spawnSync, execFileSync } from "node:child_process"; L20: import { existsSync, mkdirSync, writeFileSync, unlinkSync, rmSync, chmodSync } from "node:fs"; ... L45: for (const k of PROXY_ENV_KEYS) { L46: const v = process.env[k]; L47: if (v && v.length > 0) out[k] = v; ... L59: if (env && env.length > 0) { L60: return env.startsWith("~") ? env.replace(/^~/, homedir()) : env; L61: } ... L93: if (!existsSync(kc)) continue; L94: let stdout; L95: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/service-install.mjsView on unpkg · L18

lib/health/probes.tsView file

12import { resolvePackageAuth } from "@/lib/tools/runtime/auth-registry"; L13: import { spawnSync } from "node:child_process"; L14: ... L25: import { registerDefaultPackages } from "@/lib/tools/packages/default-packages"; L26: if (process.env.NEXT_PHASE !== "phase-production-build") { L27: registerDefaultPackages(); ... L108: try { L109: const res = await fetch(`${auth.url}/rest/api/3/myself`, { L110: headers: { L111: Authorization: "Basic " + Buffer.from(`${auth.email}:${auth.apiToken}`).toString("base64"), L112: Accept: "application/json", ... L208: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/health/probes.tsView on unpkg · L12

.next/standalone/node_modules/next/dist/compiled/@vercel/nft/index.jsView file

1(()=>{var __webpack_modules__={4816:(e,t,s)=>{"use strict";e.exports=t;const r=s(9896);const o=s(6928);const a=s(1825);const c=s(1916);const u=s(7650);const d=s(4434).EventEmitter;...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

.next/standalone/node_modules/next/dist/compiled/@vercel/nft/index.jsView on unpkg · L1

.next/standalone/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

50const _picocolors = require("../../lib/picocolors"); L51: const _child_process = /*#__PURE__*/ _interop_require_default._(require("child_process")); L52: const _fs = /*#__PURE__*/ _interop_require_default._(require("fs")); ... L177: // Explicit config always wins L178: if (process.env.REACT_EDITOR) { L179: return _shellquote.default.parse(process.env.REACT_EDITOR); ... L184: try { L185: if (process.platform === "darwin") { L186: const output = _child_process.default.execSync("ps x").toString(); ... L259: // L260: // https://developer.apple.[redacted]ASLR_classes.html#//apple_ref/doc/uid/TP40000983-CH1g-BBCIAHJF:~:... L261: return input.replaceAll(/[\\"]/g, (original)=>`\\${original}`);\n}\nfunction launchEditor(fileName, line1, column1) {\n if (!_fs.default.existsSync(fileName)) {\

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

.next/standalone/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={994:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View file

•path = .next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6 kind = native_binary sizeBytes = 18621496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View on unpkg

scripts/installed-launcher.ps1View file

•path = scripts/installed-launcher.ps1 kind = build_helper sizeBytes = 9904 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/installed-launcher.ps1View on unpkg

.next/standalone/.next/server/chunks/1427.jsView file

•path = .next/standalone/.next/server/chunks/1427.js kind = payload_in_excluded_dir sizeBytes = 6091153 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/1427.jsView on unpkg

•path = .next/standalone/.next/server/chunks/1427.js kind = oversized_source_file sizeBytes = 6091153 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

.next/standalone/.next/server/chunks/1427.jsView on unpkg

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 82

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView on unpkg

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjsView file

•matchType = normalized_sha256 matchedPackage = @circuitwall/jarela@1.41.5 matchedPath = .next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjs matchedIdentity = npm:QGNpcmN1aXR3YWxsL2phcmVsYQ:1.41.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjsView on unpkg

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.jsView file

•matchType = normalized_sha256 matchedPackage = @circuitwall/jarela@1.41.5 matchedPath = .next/standalone/node_modules/@langchain/core/dist/utils/async_caller.js matchedIdentity = npm:QGNpcmN1aXR3YWxsL2phcmVsYQ:1.41.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.jsView on unpkg

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-hint.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

app/api/v1/update/apply/route.tsView file

19import { join } from "node:path"; L20: import { spawn } from "node:child_process"; L21: import { NextResponse } from "next/server";

High

Child Process

Package source references child process execution.

app/api/v1/update/apply/route.tsView on unpkg · L19

scripts/update.mjsView file

166if (process.platform === "win32") { L167: console.error(`[jarela] (admin PowerShell) npm i -g github:${REPO}#main`); L168: } else {

High

Shell

Package source references shell execution.

scripts/update.mjsView on unpkg · L166

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/update.mjsView on unpkg · L13

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/update.mjsView on unpkg

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView file

1(()=>{var __webpack_modules__={368:e=>{function BrowserslistError(e){this.name="BrowserslistError";this.message=e;this.browserslist=true;if(Error.captureStackTrace){Error.captureSt...

High

Eval

Package source references dynamic code evaluation.

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView on unpkg · L1

browser-extension/agent-overlay.jsView file

57let applyBrand = null; L58: const brandReady = import(chrome.runtime.getURL("lib/brand.mjs")) L59: .then((m) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

browser-extension/agent-overlay.jsView on unpkg · L57

lib/embeddings/index.tsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/embeddings/index.tsView on unpkg · L51

scripts/service-install.mjsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/service-install.mjsView on unpkg · L18

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/service-install.mjsView on unpkg · L18

lib/health/probes.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/health/probes.tsView on unpkg · L12

.next/standalone/node_modules/next/dist/compiled/@vercel/nft/index.jsView file

1(()=>{var __webpack_modules__={4816:(e,t,s)=>{"use strict";e.exports=t;const r=s(9896);const o=s(6928);const a=s(1825);const c=s(1916);const u=s(7650);const d=s(4434).EventEmitter;...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

.next/standalone/node_modules/next/dist/compiled/@vercel/nft/index.jsView on unpkg · L1

.next/standalone/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

.next/standalone/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={994:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View file

•path = .next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6 kind = native_binary sizeBytes = 18621496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View on unpkg

scripts/installed-launcher.ps1View file

•path = scripts/installed-launcher.ps1 kind = build_helper sizeBytes = 9904 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/installed-launcher.ps1View on unpkg

.next/standalone/.next/server/chunks/1427.jsView file

•path = .next/standalone/.next/server/chunks/1427.js kind = payload_in_excluded_dir sizeBytes = 6091153 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/1427.jsView on unpkg

•path = .next/standalone/.next/server/chunks/1427.js kind = oversized_source_file sizeBytes = 6091153 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

.next/standalone/.next/server/chunks/1427.jsView on unpkg

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 82

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView on unpkg

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjsView on unpkg

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.jsView file

•matchType = normalized_sha256 matchedPackage = @circuitwall/jarela@1.41.5 matchedPath = .next/standalone/node_modules/@langchain/core/dist/utils/async_caller.js matchedIdentity = npm:QGNpcmN1aXR3YWxsL2phcmVsYQ:1.41.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.jsView on unpkg

Source & flagged code

21 flagged

package.jsonView file

•scripts.postinstall = node scripts/postinstall-hint.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

app/api/v1/update/apply/route.tsView file

19import { join } from "node:path"; L20: import { spawn } from "node:child_process"; L21: import { NextResponse } from "next/server";

High

Child Process

Package source references child process execution.

app/api/v1/update/apply/route.tsView on unpkg · L19

scripts/update.mjsView file

166if (process.platform === "win32") { L167: console.error(`[jarela] (admin PowerShell) npm i -g github:${REPO}#main`); L168: } else {

High

Shell

Package source references shell execution.

scripts/update.mjsView on unpkg · L166

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/update.mjsView on unpkg · L13

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/update.mjsView on unpkg

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView file

1(()=>{var __webpack_modules__={368:e=>{function BrowserslistError(e){this.name="BrowserslistError";this.message=e;this.browserslist=true;if(Error.captureStackTrace){Error.captureSt...

High

Eval

Package source references dynamic code evaluation.

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView on unpkg · L1

browser-extension/agent-overlay.jsView file

57let applyBrand = null; L58: const brandReady = import(chrome.runtime.getURL("lib/brand.mjs")) L59: .then((m) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

browser-extension/agent-overlay.jsView on unpkg · L57

lib/embeddings/index.tsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/embeddings/index.tsView on unpkg · L51

scripts/service-install.mjsView file

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/service-install.mjsView on unpkg · L18

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/service-install.mjsView on unpkg · L18

lib/health/probes.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/health/probes.tsView on unpkg · L12

.next/standalone/node_modules/next/dist/compiled/@vercel/nft/index.jsView file

1(()=>{var __webpack_modules__={4816:(e,t,s)=>{"use strict";e.exports=t;const r=s(9896);const o=s(6928);const a=s(1825);const c=s(1916);const u=s(7650);const d=s(4434).EventEmitter;...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

.next/standalone/node_modules/next/dist/compiled/@vercel/nft/index.jsView on unpkg · L1

.next/standalone/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

.next/standalone/node_modules/next/dist/next-devtools/server/launch-editor.js#virtual:normalized:round1View on unpkg · L50

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={994:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View file

•path = .next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6 kind = native_binary sizeBytes = 18621496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View on unpkg

scripts/installed-launcher.ps1View file

•path = scripts/installed-launcher.ps1 kind = build_helper sizeBytes = 9904 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/installed-launcher.ps1View on unpkg

.next/standalone/.next/server/chunks/1427.jsView file

•path = .next/standalone/.next/server/chunks/1427.js kind = payload_in_excluded_dir sizeBytes = 6091153 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/1427.jsView on unpkg

•path = .next/standalone/.next/server/chunks/1427.js kind = oversized_source_file sizeBytes = 6091153 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

.next/standalone/.next/server/chunks/1427.jsView on unpkg

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 82

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView on unpkg

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.cjsView on unpkg

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.jsView file

•matchType = normalized_sha256 matchedPackage = @circuitwall/jarela@1.41.5 matchedPath = .next/standalone/node_modules/@langchain/core/dist/utils/async_caller.js matchedIdentity = npm:QGNpcmN1aXR3YWxsL2phcmVsYQ:1.41.5 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

.next/standalone/node_modules/@langchain/core/dist/utils/async_caller.jsView on unpkg

@circuitwall/jarela@1.42.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code