@cortana-md/engine@1.4.1: Malicious npm security report (Block)

Loading npm security reports…

@cortana-md/engine@1.4.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

16 flagged

dist/hosted.cjsView file

789patternName = google_api_key severity = high line = 789 matchedText = Usage: ....ext!

High

High Secret

Package contains a high-severity secret pattern.

dist/hosted.cjsView on unpkg · L789

472\u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L473: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await rD();if(!i)return t("\u274C Failed to authenticate wi... L474:

High

Child Process

Package source references child process execution.

dist/hosted.cjsView on unpkg · L472

466L467: > Downloaded via Cortana MD Premium`,contextInfo:{externalAdReply:{title:l.title||c,body:"CORTANA MD | VIDEO DOWNLOADER",thumbnailUrl:l.thumbnail,mediaType:2,showAdAttribution:!1,s... L468: ... L472: \u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L473: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await rD();if(!i)return t("\u274C Failed to authenticate wi... L474:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hosted.cjsView on unpkg · L466

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/hosted.cjs: `);go.write(W0.format.apply(W0,e))}}Object.defineProperty(tr.exports,"isWin",{get:function(){return gc},set:function(t){gc=t}});tr.exports.warnTo=function(t){var e=go;return go=t,e... Menu file not found. Contact EDUQARIZ.`}var Ec,wn,bx,xx,Sx=b(()=>{"use strict";me();Mt();Ec=ie(require("fs"),1),wn=ie(require("path"),1),bx=["https://files.catbox.moe/j7mg5d.jpg","... https://github.com/edu-qariz/Cortana_MD https://thecortana.tech https://t.me/cortanatech https://t.me/techdepro `).map(e=>e.trim()).join(" ")};yS.O=function(t){return this.inspectOpts.colors=this.useColors,Lc.inspect(t,this.inspectOpts)}});var bS=le((r6,Bp)=>{typeof process>"u"|

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/hosted.cjsView on unpkg

789patternName = google_api_key severity = high line = 789 matchedText = Usage: ....ext!

High

Secret Pattern

Google API key in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L789

6) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(o);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);go.write(W0.format.apply(W0,e))}}Object.defineProperty(tr.exports,"isWin",{get:function(){return gc},set:function(t){gc=t}});tr.exports.warnTo=function(t){var e=go;return go=t,e...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted.cjsView on unpkg · L6

410patternName = generic_password severity = medium line = 410 matchedText = _${c.des...T-4*

Medium

Secret Pattern

Hardcoded password in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L410

1"use strict";var gM=Object.create;var da=Object.defineProperty;var yM=Object.getOwnPropertyDescriptor;var wM=Object.getOwnPropertyNames;var bM=Object.getPrototypeOf,xM=Object.proto... L2: CREATE TABLE IF NOT EXISTS ${T.identifier(i)}.${T.identifier(s)} ( ... L6: ) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(o);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);go.write(W0.format.apply(W0,e))}}Object.defineProperty(tr.exports,"isWin",{get:function(){return gc},set:function(t){gc=t}});tr.exports.warnTo=function(t){var e=go;return go=t,e... L9: ... L51: `):" "+yv(o[0]):"as no adapter specified";throw new W("There is no suitable adapter to dispatch the request "+a,"ERR_NOT_SUPPORT")}return s}v

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hosted.cjsView on unpkg · L1

dist/index.cjsView file

1"use strict";var s8=Object.create;var yl=Object.defineProperty;var o8=Object.getOwnPropertyDescriptor;var c8=Object.getOwnPropertyNames;var u8=Object.getPrototypeOf,l8=Object.proto... L2: at `+t[n].toString();return e}function g8(t){if(!t)throw new TypeError("argument namespace is required");var e=wl(),n=ss(e[1]),r=n[0];function a(i){vl.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function ss(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+xm(e)),a}function b8(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";retu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L1

1Trigger-reachable chain: scripts.start -> dist/index.cjs L1: "use strict";var s8=Object.create;var yl=Object.defineProperty;var o8=Object.getOwnPropertyDescriptor;var c8=Object.getOwnPropertyNames;var u8=Object.getPrototypeOf,l8=Object.proto... L2: at `+t[n].toString();return e}function g8(t){if(!t)throw new TypeError("argument namespace is required");var e=wl(),n=ss(e[1]),r=n[0];function a(i){vl.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function ss(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+xm(e)),a}function b8(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L1

Source & flagged code

16 flagged · loading source

dist/hosted.cjsView file

789patternName = google_api_key severity = high line = 789 matchedText = Usage: ....ext!

High

High Secret

Package contains a high-severity secret pattern.

dist/hosted.cjsView on unpkg · L789

High

Child Process

Package source references child process execution.

dist/hosted.cjsView on unpkg · L472

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hosted.cjsView on unpkg · L466

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/hosted.cjsView on unpkg

789patternName = google_api_key severity = high line = 789 matchedText = Usage: ....ext!

High

Secret Pattern

Google API key in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L789

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted.cjsView on unpkg · L6

410patternName = generic_password severity = medium line = 410 matchedText = _${c.des...T-4*

Medium

Secret Pattern

Hardcoded password in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L410

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hosted.cjsView on unpkg · L1

dist/index.cjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L1

Source & flagged code

16 flagged

dist/hosted.cjsView file

789patternName = google_api_key severity = high line = 789 matchedText = Usage: ....ext!

High

High Secret

Package contains a high-severity secret pattern.

dist/hosted.cjsView on unpkg · L789

High

Child Process

Package source references child process execution.

dist/hosted.cjsView on unpkg · L472

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hosted.cjsView on unpkg · L466

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/hosted.cjsView on unpkg

789patternName = google_api_key severity = high line = 789 matchedText = Usage: ....ext!

High

Secret Pattern

Google API key in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L789

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted.cjsView on unpkg · L6

410patternName = generic_password severity = medium line = 410 matchedText = _${c.des...T-4*

Medium

Secret Pattern

Hardcoded password in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L410

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hosted.cjsView on unpkg · L1

dist/index.cjsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L1

@cortana-md/engine@1.4.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code