@deslop/workbench: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@deslop/workbench: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/google-shared-C8nQUN7A.mjsView file

8291const executable_response_1 = require_executable_response(); L8292: const childProcess = __require("child_process"); L8293: const fs$3 = __require("fs");

High

Child Process

Package source references child process execution.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L8291

2import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CC-oIOqs.mjs"; L3: import { Mi as import_websocket } from "./server.js"; L4: import { t as sanitizeSurrogates } from "./sanitize-unicode-DceI5AnU.mjs"; ... L15: if (typeof options === "boolean") options = { forever: options }; L16: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L17: this._timeouts = timeouts; ... L328: //#endregion L329: //#region ../../node_modules/.pnpm/gaxios@7.1.6/node_modules/gaxios/package.json L330: var require_package$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L610: if (!obj || typeof obj !== "object") return; L611: else if (obj instanceof FormData || obj instanceof URLSearchParams || "forEach" in obj && "set" in obj) obj.forEach((_, key) => {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/google-shared-C8nQUN7A.mjs spawns dist/dist-zHviHa-X.mjs; helper contains network access plus dynamic code execution. L2: import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CC-oIOqs.mjs"; L3: import { Mi as import_websocket } from "./server.js"; L4: import { t as sanitizeSurrogates } from "./sanitize-unicode-DceI5AnU.mjs"; ... L15: if (typeof options === "boolean") options = { forever: options }; L16: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L17: this._timeouts = timeouts; ... L328: //#endregion L329: //#region ../../node_modules/.pnpm/gaxios@7.1.6/node_modules/gaxios/package.json L330: var require_package$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L610: if (!obj || typeof obj

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

dist/photon_rs-CAtKufSV.mjsView file

4180module.exports.__wbg_newnoargs_e643855c6572a4a8 = function(arg0, arg1) { L4181: return new Function(getStringFromWasm0(arg0, arg1)); L4182: };

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/photon_rs-CAtKufSV.mjsView on unpkg · L4180

dist/openai-codex-responses-D3EL6TtC.mjsView file

108let _os = null; L109: const dynamicImport = (specifier) => import(__rewriteRelativeImportExtension(specifier)); L110: const NODE_OS_SPECIFIER = "node:os";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/openai-codex-responses-D3EL6TtC.mjsView on unpkg · L108

dist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 10530334 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

•path = dist/server.js kind = oversized_cli_entrypoint sizeBytes = 10530334 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.jsView on unpkg

Source & flagged code

9 flagged

dist/google-shared-C8nQUN7A.mjsView file

8291const executable_response_1 = require_executable_response(); L8292: const childProcess = __require("child_process"); L8293: const fs$3 = __require("fs");

High

Child Process

Package source references child process execution.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L8291

2import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CC-oIOqs.mjs"; L3: import { Mi as import_websocket } from "./server.js"; L4: import { t as sanitizeSurrogates } from "./sanitize-unicode-DceI5AnU.mjs"; ... L15: if (typeof options === "boolean") options = { forever: options }; L16: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L17: this._timeouts = timeouts; ... L328: //#endregion L329: //#region ../../node_modules/.pnpm/gaxios@7.1.6/node_modules/gaxios/package.json L330: var require_package$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L610: if (!obj || typeof obj !== "object") return; L611: else if (obj instanceof FormData || obj instanceof URLSearchParams || "forEach" in obj && "set" in obj) obj.forEach((_, key) => {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/google-shared-C8nQUN7A.mjs spawns dist/dist-zHviHa-X.mjs; helper contains network access plus dynamic code execution. L2: import { i as __require, o as __toESM, t as __commonJSMin } from "./rolldown-runtime-CC-oIOqs.mjs"; L3: import { Mi as import_websocket } from "./server.js"; L4: import { t as sanitizeSurrogates } from "./sanitize-unicode-DceI5AnU.mjs"; ... L15: if (typeof options === "boolean") options = { forever: options }; L16: this._originalTimeouts = JSON.parse(JSON.stringify(timeouts)); L17: this._timeouts = timeouts; ... L328: //#endregion L329: //#region ../../node_modules/.pnpm/gaxios@7.1.6/node_modules/gaxios/package.json L330: var require_package$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => { ... L610: if (!obj || typeof obj

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/google-shared-C8nQUN7A.mjsView on unpkg · L2

dist/photon_rs-CAtKufSV.mjsView file

Lines 4160-4200javascript

4160 module.exports.__wbg_height_3a8bec2f3fe71b26 = function(arg0) {

4161 return arg0.height;

4162 };

4163 module.exports.__wbg_setheight_1761808c18403921

dist/openai-codex-responses-D3EL6TtC.mjsView file

Lines 88-128javascript

88function resolveHttpProxyUrlForTarget(targetUrl, env) {

89 const proxy = getProxyForUrl(targetUrl, env);

90 if (!proxy) return;

dist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View file

•path = dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2 kind = high_entropy_blob sizeBytes = 40404 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/jetbrains-mono-latin-wght-normal-B9CIFXIH.woff2View on unpkg

dist/server.jsView file

•path = dist/server.js kind = oversized_source_file sizeBytes = 10530334 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server.jsView on unpkg

•path = dist/server.js kind = oversized_cli_entrypoint sizeBytes = 10530334 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/server.jsView on unpkg