@debugbundle/cli@1.7.0: Suspicious npm security report (Warn)

Loading npm security reports…

@debugbundle/cli@1.7.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged

6018if (typeof execResult === "undefined") { L6019: throw new Error("Pipeline cannot be used to send any commands when the `exec()` has been called on it."); L6020: }

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L6018

25917} L25918: import_node_process.stdout.write("Enter 1, 2, 3, or 4.\n"); L25919: } ... L25925: // src/login-command.ts L25926: var import_node_child_process = require("node:child_process"); L25927: var import_node_util = require("node:util"); L25928: var execFile = (0, import_node_util.promisify)(import_node_child_process.execFile); L25929: var DEFAULT_BASE_URL = "https://api.debugbundle.com"; L25930: var DEFAULT_GITHUB_BOOTSTRAP_LABEL = "GitHub bootstrap";

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.cjsView on unpkg · L25917

26792patternName = generic_password severity = medium line = 26792 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/main.cjsView on unpkg · L26792

bin/debugbundle.jsView file

Lines 1-11javascript

1#!/usr/bin/env node

2import { createRequire } from "node:module";

3import { dirname, resolve } from "node:path";

4import { fileURLToPath } from "node:url";

6const

Source & flagged code

4 flagged · loading source

dist/main.cjsView file

6018if (typeof execResult === "undefined") { L6019: throw new Error("Pipeline cannot be used to send any commands when the `exec()` has been called on it."); L6020: }

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L6018

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/main.cjsView on unpkg · L25917

26792patternName = generic_password severity = medium line = 26792 matchedText = password...rd",

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/main.cjsView on unpkg · L26792

bin/debugbundle.jsView file

5L6: const require = createRequire(import.meta.url); L7: const binDirectory = dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/debugbundle.jsView on unpkg · L5

@debugbundle/cli@1.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code