@comate/zulu@1.7.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@comate/zulu@1.7.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

scripts/postinstall.jsView file

13L14: import {execSync} from 'node:child_process'; L15: import {

High

Child Process

Package source references child process execution.

scripts/postinstall.jsView on unpkg · L13

226const findCmd = isWindows L227: ? `powershell -Command "Get-ChildItem -Path '${searchDir}' -Filter 'rg.exe' -Recurse ` + L228: '| Select-Object -First 1 -ExpandProperty FullName"'

High

Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L226

dist/bundle/index.jsView file

32* Licensed under the MIT License. L33: */const util$3=require$$0$5,toRegexRange=toRegexRange_1,isObject$6=e=>null!==e&&"object"==typeof e&&!Array.isArray(e),transform=e=>t=>!0===e?Number(t):String(t),isValidValue=e=>"nu... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,i,n=!0;function s(e){... L36: /** ... L42: * Copyright Jeremy Ashkenas, DocumentCloud and Investigative Reporters & Editors L43: */lodash$2.exports,function(e,t){(function(){var A,r="Expected a function",i="__lodash_has

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/bundle/index.jsView on unpkg · L32

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,A=require$$1__default.extname,r=/^\s*([^;\s]*)(?:;|\s|$)/,i=/^text\//i;function n(e){if(!e||"string"!=typeof e)return!1;var A=r.exec(e),n=A&&t[A[1].toLowe... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,i,n=!0;function s(e){... L36: /** ... L4

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist/bundle/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bundle/index.jsView on unpkg · L1

•matchType = previous_version_dangerous_delta matchedPackage = @comate/zulu@1.6.4 matchedIdentity = npm:QGNvbWF0ZS96dWx1:1.6.4 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bundle/index.jsView on unpkg

48* Licensed under the MIT License. L49: */var isExtendable=function(e){return null!=e&&("object"==typeof e||"function"==typeof e)},isObject$1=isExtendable,extendShallow=function(e){isObject$1(e)||(e={});for(var t=argumen...

High

Eval

Package source references dynamic code evaluation.

dist/bundle/index.jsView on unpkg · L48

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/bundle/index.jsView on unpkg · L1

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,A=require$$1__default.extname,r=/^\s*([^;\s]*)(?:;|\s|$)/,i=/^text\//i;function n(e){if(!e||"string"!=typeof e)return!1;var A=r.exec(e),n=A&&t[A[1].toLowe... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,i,n=!0;function s(e){... L36: /** ... L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/bundle/index.jsView on unpkg · L1

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/bundle/index.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/bundle/index.js L1: import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*!

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bundle/index.jsView on unpkg · L1

•path = dist/bundle/index.js kind = oversized_source_file sizeBytes = 4246181 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bundle/index.jsView on unpkg

1import{fileURLToPath as __zuluFileURLToPath}from"url";import{dirname as __zuluDirname}from"path";const __dirname=__zuluDirname(__zuluFileURLToPath(import.meta.url));import*as fs$y ... L2: /*! ... L7: */ L8: !function(e){var t=mimeDb,A=require$$1__default.extname,r=/^\s*([^;\s]*)(?:;|\s|$)/,i=/^text\//i;function n(e){if(!e||"string"!=typeof e)return!1;var A=r.exec(e),n=A&&t[A[1].toLowe... L9: /*! ... L34: /*! queue-microtask. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */let promise;out.Settings=settings_1$3.default,out.stat=stat$4,out.statSync=statSync;var queu... L35: /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */const queueMicrotask$1=queueMicrotask_1;function runParallel(e,t){let A,r,i,n=!0;function s(e){... L36: /** ... L4

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bundle/index.jsView on unpkg · L1

comate-engine/assets/hooks/local-swe-task-reporter.jsView file

5import fs from 'node:fs'; L6: import http from 'node:http'; L7: import https from 'node:https'; ... L9: import path from 'node:path'; L10: import {execFileSync} from 'node:child_process'; L11: L12: const STATE_ROOT = L13: process.env.COMATE_BUILTIN_HOOK_STATE_DIR || path.join(os.homedir(), '.comate', 'builtin-hook-state'); L14: const STATE_DIR = path.join(STATE_ROOT, 'local-swe-task');

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

comate-engine/assets/hooks/local-swe-task-reporter.jsView on unpkg · L5

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView file

•path = comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.py kind = payload_in_excluded_dir sizeBytes = 1118 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

comate-engine/assets/skills/build-swe-data-auto/tests/test_language_detector.pyView on unpkg