@dmccore/code@0.0.33-synaptic.10: Malicious npm security report

Loading npm security reports…

@dmccore/code@0.0.33-synaptic.10: Malicious npm security report | LPM Firewall

Source & flagged code

17 flagged

dist/NodeServices-Ca--v9Zz.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import { Ao as succeed$3, Bi as orDie, Cr as as, Dd as identity, Dl as of, Do as mergeAll, Dr as callback, Du as none, Ei as map, Es as fail$2, Eu as match, Io as addFinalizer, Ir as catch_, Jl as succeed, Jo as _await, Kr as fail, Lr as clockWith, Lt as tag, Ni as matchEffect, Oa as void_, Od as pipe, Oi as mapError, Or as catchCause, Qr as flatMap, Ss as UnknownError, Td as dual, Tr as asVoid, Ts as done, Ur as effectify, Xo as doneUnsafe, Yu as BaseProto, Zi as runFork, Zl as Service, _s as Done, _u as getOrElse, ba as tryPromise, bo as effect, ca as succeed$1, ci as forkScoped, cs as fail$ ...

4import { $t as poll, B as merge, Dt as fromChannel, E as fromChannel$1, Ft as mapDone, Gt as endUnsafe, Jt as failCauseUnsafe, Ot as isSink, P as isStream, Pt as fromTransform, Qt as offerUnsafe, Sn as systemError, Tt as drain, V as mkString, X as run, Xt as offer, Yt as make$10, Z as

5import { createRequire } from "node:module";

6import * as NodeChildProcess from "node:child_process";

7import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Ca--v9Zz.mjsView on unpkg · L5

8import * as NodeCrypto from "node:crypto";

9import * as NFS from "node:fs";

10import * as OS from "node:os";

11import * as Path from "node:path";

12import * as NodeUrl from "node:url";

13import * as readline from "node:readline";

14//#region \0rolldown/runtime.js

15var __create = Object.create;

16var __defProp = Object.defineProperty;

17var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

18var __getOwnPropNames = Object.getOwnPropertyNames;

19var __getProtoOf = Object.getPrototypeOf;

20var __hasOwnProp = Object.prototype.hasOwnProperty;

21var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

22var __exportAll = (all, no_symbols) => {

23 let target = {};

24 for (var name in all) __defProp(target, name, {

25 get: all[name],

Long lines were clipped for display.

5Cross-file remote execution chain: dist/NodeServices-Ca--v9Zz.mjs spawns dist/Schema-DNmPah4h.mjs; helper contains network access plus dynamic code execution. L5: import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream"; ... L76: * operating-system processes. A spawner turns a command description into a L77: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L78: * the process, and manage whether the process keeps its parent alive. Platform ... L433: return callback(function loop(resume) { L434: for (; i < chunk.length;) if (!options.writable.write(chunk[i++], options.encoding)) { L435: options.writable.once("drain", () => loop(resume)); ... L675: return options.extendEn

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Ca--v9Zz.mjsView on unpkg · L5

dist/bin.mjsView file

3import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$96, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$141, i as Terminal$1, l ... L4: import { $ as decode$5, $c as max, $l as empty$8, $n as toDate, $r as flatMapEager, $t as toJsonSchemaMultiDocument, $u as format, A as Record, Aa as whileLoop, Ai as match$2, Al a... L5: import { $ as runFold$1, A as fromQueue, At as mapInput$1, B as merge$4, Bt as make$155, C as flatMap$3, D as fromEffect, Et as forEach$1, F as make$154, G as orDie$1, Ht as bounde... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: import { cwd } from "process"; L21: import * as NodeNet from

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/client/assets/sass-DXrisJhu.jsView file

Lines 1-2javascript

1var e=[Object.freeze(JSON.parse(`{"displayName":"Sass","fileTypes":["sass"],"foldingStartMarker":"/\\\\*|^#|^\\\\*|^\\\\b|\\\\*#?region|^\\\\.","foldingStopMarker":"\\\\*/|\\\\*#?endregion|^\\\\s*$","name":"sass","patterns":[{"begin":"^(

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

Source & flagged code

17 flagged · loading source

dist/NodeServices-Ca--v9Zz.mjsView file

5import { createRequire } from "node:module"; L6: import * as NodeChildProcess from "node:child_process"; L7: import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Ca--v9Zz.mjsView on unpkg · L5

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Ca--v9Zz.mjsView on unpkg · L5

dist/bin.mjsView file

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

3Trigger-reachable chain: scripts.start -> dist/bin.mjs L3: import { _ as __commonJSMin, a as isQuitError, b as __toESM, c as layer$96, d as pipeThroughDuplex, f as toArrayBuffer, g as ChildProcessSpawner, h as make$141, i as Terminal$1, l ... L4: import { $ as decode$5, $c as max, $l as empty$8, $n as toDate, $r as flatMapEager, $t as toJsonSchemaMultiDocument, $u as format, A as Record, Aa as whileLoop, Ai as match$2, Al a... L5: import { $ as runFold$1, A as fromQueue, At as mapInput$1, B as merge$4, Bt as make$155, C as flatMap$3, D as fromEffect, Et as forEach$1, F as make$154, G as orDie$1, Ht as bounde... ... L9: import { createRequire } from "node:module"; L10: import * as NodeChildProcess from "node:child_process"; L11: import { Duplex, Readable } from "node:stream"; ... L20: impor

dist/client/assets/sass-DXrisJhu.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/sass-DXrisJhu.jsView on unpkg · L1

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

Source & flagged code

17 flagged

dist/NodeServices-Ca--v9Zz.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

5import { createRequire } from "node:module";

6import * as NodeChildProcess from "node:child_process";

7import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Ca--v9Zz.mjsView on unpkg · L5

8import * as NodeCrypto from "node:crypto";

9import * as NFS from "node:fs";

10import * as OS from "node:os";

11import * as Path from "node:path";

12import * as NodeUrl from "node:url";

13import * as readline from "node:readline";

14//#region \0rolldown/runtime.js

15var __create = Object.create;

16var __defProp = Object.defineProperty;

17var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

18var __getOwnPropNames = Object.getOwnPropertyNames;

19var __getProtoOf = Object.getPrototypeOf;

20var __hasOwnProp = Object.prototype.hasOwnProperty;

21var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);

22var __exportAll = (all, no_symbols) => {

23 let target = {};

24 for (var name in all) __defProp(target, name, {

25 get: all[name],

Long lines were clipped for display.

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Ca--v9Zz.mjsView on unpkg · L5

dist/bin.mjsView file

Critical

Sensitive Archive Exfiltration

Source archives sensitive local configuration and publishes encoded chunks through an authenticated package-registry request.

dist/bin.mjsView on unpkg · L3

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/bin.mjsView on unpkg · L3

dist/client/assets/sass-DXrisJhu.jsView file

Lines 1-2javascript

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

@dmccore/code@0.0.33-synaptic.10

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code