@dmccore/code@0.0.32-synaptic.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@dmccore/code@0.0.32-synaptic.1: Suspicious npm security report | LPM Firewall

Source & flagged code

13 flagged · loading source

dist/service-launcher.mjsView file

2L3: import * as NodeChildProcess from "node:child_process"; L4: import * as NodeCrypto from "node:crypto";

High

Child Process

Package source references child process execution.

dist/service-launcher.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/service-launcher.mjs spawns dist/bin.mjs; helper contains network access plus dynamic code execution. L2: L3: import * as NodeChildProcess from "node:child_process"; L4: import * as NodeCrypto from "node:crypto"; ... L89: try { L90: return decodeServiceState(JSON.parse(value)); L91: } catch { ... L283: } L284: child.send(message, (error) => error === null ? resolve() : reject(error)); L285: }); ... L287: function waitForExit(child) { L288: if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(); L289: return new Promise((resolve) => child.once("exit", () => resolve()));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/service-launcher.mjsView on unpkg · L2

dist/bin.mjsView file

8import { Argument, Command, Flag, GlobalFlag, Prompt } from "effect/unstable/cli"; L9: import * as NodeNet from "node:net"; L10: import * as Data from "effect/Data"; ... L56: import * as NodePath from "node:path"; L57: import * as NodeChildProcess from "node:child_process"; L58: import * as Clock from "effect/Clock"; ... L243: //#endregion L244: //#region package.json L245: var version = "0.0.32-synaptic.1"; ... L2017: correlationId: Schema$1.NullOr(CommandId), L2018: metadata: OrchestrationEventMetadata L2019: };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/bin.mjsView on unpkg · L8

8Trigger-reachable chain: scripts.start -> dist/bin.mjs L8: import { Argument, Command, Flag, GlobalFlag, Prompt } from "effect/unstable/cli"; L9: import * as NodeNet from "node:net"; L10: import * as Data from "effect/Data"; ... L56: import * as NodePath from "node:path"; L57: import * as NodeChildProcess from "node:child_process"; L58: import * as Clock from "effect/Clock"; ... L243: //#endregion L244: //#region package.json L245: var version = "0.0.32-synaptic.1"; ... L2017: correlationId: Schema$1.NullOr(CommandId), L2018: metadata: OrchestrationEventMetadata L2019: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L8

16103const POSIX_PATH_DELIMITER = ":"; L16104: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L16105: function canExecuteFile(filePath) {

High

Shell

Package source references shell execution.

dist/bin.mjsView on unpkg · L16103

dist/client/assets/typescript-6EZ4VmV4.jsView file

1import{tp as e}from"./textarea-D7rmjYUo.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse('{"displayName":"TypeScript","name":"typescript","patterns":[{"include":"#directive... L2: //# sourceMappingURL=typescript-6EZ4VmV4.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/typescript-6EZ4VmV4.jsView on unpkg · L1

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

Source & flagged code

13 flagged

dist/service-launcher.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3import * as NodeChildProcess from "node:child_process";

4import * as NodeCrypto from "node:crypto";

High

Child Process

Package source references child process execution.

dist/service-launcher.mjsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/service-launcher.mjsView on unpkg · L2

5import * as NodeFS from "node:fs";

6import * as NodeFSP from "node:fs/promises";

7import * as NodePath from "node:path";

8const SERVICE_LAUNCHER_CONTEXT_ENV = "SYNAPTIC_SERVICE_LAUNCHER_CONTEXT";

9const SERVICE_STATE_FILE = "service-state.json";

10/** Written by the launcher just before an explicit stop kills its child, so

11the child can tell "the service is going away" from "the launcher is about

12to start my replacement" while a pending update is recorded. */

13const SERVICE_STOP_MARKER_FILE = ".service-stopping";

14const SEMVER_NUMBER = "(?:0|[1-9]\\d*)";

15const SEMVER_PRERELEASE = `(?:${SEMVER_NUMBER}|[0-9]*[A-Za-z-][0-9A-Za-z-]*)`;

16const EXACT_SERVICE_VERSION = new RegExp(`^${SEMVER_NUMBER}\\.${SEMVER_NUMBER}\\.${SEMVER_NUMBER}(?:-${SEMVER_PRERELEASE}(?:\\.${SEMVER_PRERELEASE})*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`);

17/** Accepts exact SemVer only: never dist-tags or ranges passed to npm or filesystem paths. */

18const isExactServiceVersion = (version) => EXACT_SERVICE_VERSION.test(version);

19const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

20function decodeServiceUpdate(value) {

21 if (!isRecord(value)) return void 0;

22 const { id, fromVersion, targetVersion, status } = value;

dist/bin.mjsView file

8import { Argument, Command, Flag, GlobalFlag, Prompt } from "effect/unstable/cli"; L9: import * as NodeNet from "node:net"; L10: import * as Data from "effect/Data"; ... L56: import * as NodePath from "node:path"; L57: import * as NodeChildProcess from "node:child_process"; L58: import * as Clock from "effect/Clock"; ... L243: //#endregion L244: //#region package.json L245: var version = "0.0.32-synaptic.1"; ... L2017: correlationId: Schema$1.NullOr(CommandId), L2018: metadata: OrchestrationEventMetadata L2019: };

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/bin.mjsView on unpkg · L8

8Trigger-reachable chain: scripts.start -> dist/bin.mjs L8: import { Argument, Command, Flag, GlobalFlag, Prompt } from "effect/unstable/cli"; L9: import * as NodeNet from "node:net"; L10: import * as Data from "effect/Data"; ... L56: import * as NodePath from "node:path"; L57: import * as NodeChildProcess from "node:child_process"; L58: import * as Clock from "effect/Clock"; ... L243: //#endregion L244: //#region package.json L245: var version = "0.0.32-synaptic.1"; ... L2017: correlationId: Schema$1.NullOr(CommandId), L2018: metadata: OrchestrationEventMetadata L2019: };

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/bin.mjsView on unpkg · L8

16103const POSIX_PATH_DELIMITER = ":"; L16104: const WINDOWS_SHELL_CANDIDATES = ["pwsh.exe", "powershell.exe"]; L16105: function canExecuteFile(filePath) {

High

dist/client/assets/typescript-6EZ4VmV4.jsView file

Lines 1-2javascript

1import{tp as e}from"./textarea-D7rmjYUo.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse('{"displayName":"TypeScript","name":"typescript","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![$_[:alnum:]])(?:(?<=\\\\

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg