@codex-ultra/cxu@0.2.53: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@codex-ultra/cxu@0.2.53: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

1import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe...

High

Child Process

Package source references child process execution.

dist/postinstall.jsView on unpkg · L1

1import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.jsView on unpkg · L1

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x5215ac,_0x56c3f3){function _0x47e319(_0x1e743e,_0x3ebc35,_0x3f045b,_0x32da80){return _0x29b7(_0x3ebc35-0x362,_0x3f045b);}const _0x57c4b5=_0x5215ac();function _0x3ce5e1... Write operation from dist/postinstall.js: L1: import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

1(function(_0x5215ac,_0x56c3f3){function _0x47e319(_0x1e743e,_0x3ebc35,_0x3f045b,_0x32da80){return _0x29b7(_0x3ebc35-0x362,_0x3f045b);}const _0x57c4b5=_0x5215ac();function _0x3ce5e1...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1(function(_0x5215ac,_0x56c3f3){function _0x47e319(_0x1e743e,_0x3ebc35,_0x3f045b,_0x32da80){return _0x29b7(_0x3ebc35-0x362,_0x3f045b);}const _0x57c4b5=_0x5215ac();function _0x3ce5e1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

server-bundle/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.67 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.67 similarity = 0.583 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server-bundle/index.jsView on unpkg

1Cross-file remote execution chain: server-bundle/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: var zq=Object.create;var OR=Object.defineProperty;var fq=Object.getOwnPropertyDescriptor;var Uq=Object.getOwnPropertyNames;var Oq=Object.getPrototypeOf,Bq=Object.prototype.hasOwnPr... L2: `,G===l&&(t+=" ".repeat(c+e+2),t+=`^ ... L8: `||e==="\r"&&I[s+1]===` L9: `))a=a&&3;else{if(e<" "&&e!==" "||e==="\x7F")throw new UI("control characters are not allowed in strings",{toml:I,ptr:s});if((!a||a===3)&&e===n&&(!c||I[s+1]===n&&I[s+2]===n))return... L10: `;else if(e==="f")G+="\f";else if(e==="r")G+="\r";else if(e==="e")G+="\x1B";else if(e==='"')G+='"';else if(e==="\\")G+="\\";else throw new UI("unrecognized escape sequence",{toml:I... ... L29: `?n+` L30: `:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server-bundle/index.jsView on unpkg · L1

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-mz0af371.jsView file

•path = web-dist/assets/main-mz0af371.js kind = oversized_source_file sizeBytes = 9148041 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-mz0af371.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

•scripts.postinstall = node dist/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node dist/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

1import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe...

High

Child Process

Package source references child process execution.

dist/postinstall.jsView on unpkg · L1

1import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe...

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/postinstall.jsView on unpkg · L1

dist/index.jsView file

1Install-time code directly mutates a foreign AI-agent control surface: L1: (function(_0x5215ac,_0x56c3f3){function _0x47e319(_0x1e743e,_0x3ebc35,_0x3f045b,_0x32da80){return _0x29b7(_0x3ebc35-0x362,_0x3f045b);}const _0x57c4b5=_0x5215ac();function _0x3ce5e1... Write operation from dist/postinstall.js: L1: import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe... Foreign user/project scope from dist/postinstall.js: L1: import{spawnSync as w}from"node:child_process";import{chmodSync as k,copyFileSync as p,existsSync as o,mkdirSync as m,statSync as h,writeFileSync as B}from"node:fs";import{createRe...

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

dist/index.jsView on unpkg · L1

1(function(_0x5215ac,_0x56c3f3){function _0x47e319(_0x1e743e,_0x3ebc35,_0x3f045b,_0x32da80){return _0x29b7(_0x3ebc35-0x362,_0x3f045b);}const _0x57c4b5=_0x5215ac();function _0x3ce5e1...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1(function(_0x5215ac,_0x56c3f3){function _0x47e319(_0x1e743e,_0x3ebc35,_0x3f045b,_0x32da80){return _0x29b7(_0x3ebc35-0x362,_0x3f045b);}const _0x57c4b5=_0x5215ac();function _0x3ce5e1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

server-bundle/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @codex-ultra/cxu@0.2.67 matchedIdentity = npm:QGNvZGV4LXVsdHJhL2N4dQ:0.2.67 similarity = 0.583 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server-bundle/index.jsView on unpkg

1Cross-file remote execution chain: server-bundle/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L1: var zq=Object.create;var OR=Object.defineProperty;var fq=Object.getOwnPropertyDescriptor;var Uq=Object.getOwnPropertyNames;var Oq=Object.getPrototypeOf,Bq=Object.prototype.hasOwnPr... L2: `,G===l&&(t+=" ".repeat(c+e+2),t+=`^ ... L8: `||e==="\r"&&I[s+1]===` L9: `))a=a&&3;else{if(e<" "&&e!==" "||e==="\x7F")throw new UI("control characters are not allowed in strings",{toml:I,ptr:s});if((!a||a===3)&&e===n&&(!c||I[s+1]===n&&I[s+2]===n))return... L10: `;else if(e==="f")G+="\f";else if(e==="r")G+="\r";else if(e==="e")G+="\x1B";else if(e==='"')G+='"';else if(e==="\\")G+="\\";else throw new UI("unrecognized escape sequence",{toml:I... ... L29: `?n+` L30: `:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server-bundle/index.jsView on unpkg · L1

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

web-dist/assets/main-mz0af371.jsView file

•path = web-dist/assets/main-mz0af371.js kind = oversized_source_file sizeBytes = 9148041 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

web-dist/assets/main-mz0af371.jsView on unpkg