@co0ontty/wand@4.28.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@co0ontty/wand@4.28.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

15 flagged · loading source

dist/config.jsView file

56patternName = generic_password severity = medium line = 56 matchedText = password...me",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/config.jsView on unpkg · L56

dist/structured-codex-adapter.jsView file

1import { spawn } from "node:child_process"; L2: import { CodexProtocolReducer } from "./structured-codex-protocol.js";

High

Child Process

Package source references child process execution.

dist/structured-codex-adapter.jsView on unpkg · L1

dist/git-utils.jsView file

34} L35: function gitExecAsyncOptions(cwd, opts) { L36: return {

High

Shell

Package source references shell execution.

dist/git-utils.jsView on unpkg · L34

dist/tui/layout.jsView file

2import { stripAnsi } from "../pty-text-utils.js"; L3: const require = createRequire(import.meta.url); L4: // neo-blessed 是 CJS，没有匹配 @types/blessed 的 default export，统一当 any 用。

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/tui/layout.jsView on unpkg · L2

dist/password-manager.jsView file

1import crypto from "node:crypto"; L2: export const DEFAULT_BROWSER_EXTENSION_BASE_URL = "https://home.huniu.fun:8183"; L3: export const DEFAULT_PASSWORD_VAULT_ID = "personal"; ... L277: if (/^[0-9a-f]+$/i.test(cleaned) && cleaned.length % 2 === 0) { L278: return Buffer.from(cleaned, "hex"); L279: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/password-manager.jsView on unpkg · L1

dist/tui/commands.jsView file

4Trigger-reachable persistence chain: manifest.bin -> dist/cli.js -> dist/tui/commands.js L4: * 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L37: stdio: "inherit", L38: env: process.env, L39: }); ... L105: export function openInBrowser(url) { L106: const cmd = process.platform === "darwin" L107: ? "open" ... L131: ok: false,

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/tui/commands.jsView on unpkg · L4

4* 所有命令统一返回 CommandResult，UI 层负责把结果渲染到 toast / 弹窗 / 日志。 L5: * 命令本身不直接写 stdout / stderr —— TUI 模式下 stderr 已经被 log-bus 劫持。 L6: */ L7: import { spawn, spawnSync } from "node:child_process"; L8: import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, unlinkSync } from "node:fs"; ... L37: stdio: "inherit", L38: env: process.env, L39: }); ... L105: export function openInBrowser(url) { L106: const cmd = process.platform === "darwin" L107: ? "open" ... L131: ok: false,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/tui/commands.jsView on unpkg · L4

dist/server.jsView file

5Cross-file remote execution chain: dist/server.js spawns dist/web-ui/content/vendor/qrcode/qrcode.bundle.js; helper contains network access plus dynamic code execution. L5: import { stat } from "node:fs/promises"; L6: import { createServer as createHttpServer } from "node:http"; L7: import { createServer as createHttpsServer } from "node:https"; L8: import { spawn } from "node:child_process"; L9: import os from "node:os"; ... L52: // ── Package info ── L53: const PKG_JSON = JSON.parse(readFileSync(path.join(RUNTIME_ROOT_DIR, "package.json"), "utf8")); L54: const PKG_NAME = PKG_JSON.name; ... L96: function isExternalAvatarSource(value) { L97: return /^(https?:|data:)/i.test(value); L98: } ... L358: const candidates = [];

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server.jsView on unpkg · L5

5Detached bundled service listener: dist/server.js launches a Node helper and exposes a broad-bound HTTP listener. L5: import { stat } from "node:fs/promises"; L6: import { createServer as createHttpServer } from "node:http"; L7: import { createServer as createHttpsServer } from "node:https"; L8: import { spawn } from "node:child_process"; L9: import os from "node:os"; ... L52: // ── Package info ── L53: const PKG_JSON = JSON.parse(readFileSync(path.join(RUNTIME_ROOT_DIR, "package.json"), "utf8")); L54: const PKG_NAME = PKG_JSON.name; ... L96: function isExternalAvatarSource(value) { L97: return /^(https?:|data:)/i.test(value); L98: } ... L358: const candidates = [];

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/server.jsView on unpkg · L5

dist/web-ui/embedded-assets.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/web-ui/embedded-assets.jsView on unpkg

dist/npm-update-utils.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.39.0 matchedPath = dist/npm[redacted] matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.39.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/npm-update-utils.jsView on unpkg

dist/path-repair.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.39.0 matchedPath = dist/path-repair.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.39.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/path-repair.jsView on unpkg

dist/provider-cli-updater.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.39.0 matchedPath = dist/provider-cli-updater.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.39.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-cli-updater.jsView on unpkg

dist/update-helper.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.39.0 matchedPath = dist/update-helper.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.39.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/update-helper.jsView on unpkg

dist/git-quick-commit.jsView file

•matchType = normalized_sha256 matchedPackage = @co0ontty/wand@4.39.0 matchedPath = dist/git-quick-commit.js matchedIdentity = npm:QGNvMG9udHR5L3dhbmQ:4.39.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/git-quick-commit.jsView on unpkg