@dmccore/code@0.0.33-synaptic.6: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@dmccore/code@0.0.33-synaptic.6: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/service-launcher.mjsView file

2L3: import * as NodeChildProcess from "node:child_process"; L4: import * as NodeCrypto from "node:crypto";

High

Child Process

Package source references child process execution.

dist/service-launcher.mjsView on unpkg · L2

2Cross-file remote execution chain: dist/service-launcher.mjs spawns dist/bin.mjs; helper contains network access plus dynamic code execution. L2: L3: import * as NodeChildProcess from "node:child_process"; L4: import * as NodeCrypto from "node:crypto"; ... L89: try { L90: return decodeServiceState(JSON.parse(value)); L91: } catch { ... L283: } L284: child.send(message, (error) => error === null ? resolve() : reject(error)); L285: }); ... L287: function waitForExit(child) { L288: if (child.exitCode !== null || child.signalCode !== null) return Promise.resolve(); L289: return new Promise((resolve) => child.once("exit", () => resolve()));

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/service-launcher.mjsView on unpkg · L2

dist/client/assets/jsx-CoO1nHsB.jsView file

1import{lp as e}from"./textarea-C02fQkm-.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse(`{"displayName":"JSX","name":"jsx","patterns":[{"include":"#directives"},{"include"... L2: //# sourceMappingURL=jsx-CoO1nHsB.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/jsx-CoO1nHsB.jsView on unpkg · L1

dist/bin.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", { baseUrl: Schema$1.String httpBaseUrl: TrimmedNonEmptyString, wsBaseUrl: TrimmedNonEmptyString, const RelayClientBearerAuthorization = HttpApiSecurity.http({ scheme: "bearer" }).pipe(HttpApiSecurity.annotate(OpenApi.Description, "Clerk session or OAuth bearer token for the si... security: { clientBearer: RelayClientBearerAuthorization } const [redacted] = HttpApiSecurity.http({ scheme: "bearer" }).pipe(HttpApiSecurity.annotate(OpenApi.Description, "Relay-issued envi

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 4822614 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 4822614 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/client/assets/index-D_DS0xgU.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/index-D_DS0xgU.jsView on unpkg

dist/NodePtyAdapter-CHGVwPo2.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dmccore/code@0.0.32-synaptic.7 matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.32-synaptic.7 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/NodePtyAdapter-CHGVwPo2.mjsView on unpkg

Source & flagged code

9 flagged

dist/service-launcher.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3import * as NodeChildProcess from "node:child_process";

4import * as NodeCrypto from "node:crypto";

High

Child Process

Package source references child process execution.

dist/service-launcher.mjsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/service-launcher.mjsView on unpkg · L2

5import * as NodeFS from "node:fs";

6import * as NodeFSP from "node:fs/promises";

7import * as NodePath from "node:path";

8const SERVICE_LAUNCHER_CONTEXT_ENV = "SYNAPTIC_SERVICE_LAUNCHER_CONTEXT";

9const SERVICE_STATE_FILE = "service-state.json";

10/** Written by the launcher just before an explicit stop kills its child, so

11the child can tell "the service is going away" from "the launcher is about

12to start my replacement" while a pending update is recorded. */

13const SERVICE_STOP_MARKER_FILE = ".service-stopping";

14const SEMVER_NUMBER = "(?:0|[1-9]\\d*)";

15const SEMVER_PRERELEASE = `(?:${SEMVER_NUMBER}|[0-9]*[A-Za-z-][0-9A-Za-z-]*)`;

16const EXACT_SERVICE_VERSION = new RegExp(`^${SEMVER_NUMBER}\\.${SEMVER_NUMBER}\\.${SEMVER_NUMBER}(?:-${SEMVER_PRERELEASE}(?:\\.${SEMVER_PRERELEASE})*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$`);

17/** Accepts exact SemVer only: never dist-tags or ranges passed to npm or filesystem paths. */

18const isExactServiceVersion = (version) => EXACT_SERVICE_VERSION.test(version);

19const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);

20function decodeServiceUpdate(value) {

21 if (!isRecord(value)) return void 0;

22 const { id, fromVersion, targetVersion, status } = value;

dist/client/assets/jsx-CoO1nHsB.jsView file

Lines 1-2javascript

1import{lp as e}from"./textarea-C02fQkm-.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse(`{"displayName":"JSX","name":"jsx","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![$_[:alnum:]])(?:(?<=\\\\

dist/bin.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/bin.mjs: import * as NodeReadline from "node:readline"; var EnvironmentAuthorizationError = class extends Schema$1.TaggedErrorClass()("EnvironmentAuthorizationError", { baseUrl: Schema$1.String httpBaseUrl: TrimmedNonEmptyString, wsBaseUrl: TrimmedNonEmptyString, const RelayClientBearerAuthorization = HttpApiSecurity.http({ scheme: "bearer" }).pipe(HttpApiSecurity.annotate(OpenApi.Description, "Clerk session or OAuth bearer token for the si... security: { clientBearer: RelayClientBearerAuthorization } const [redacted] = HttpApiSecurity.http({ scheme: "bearer" }).pipe(HttpApiSecurity.annotate(OpenApi.Description, "Relay-issued envi

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 4822614 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 4822614 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/client/assets/index-D_DS0xgU.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/client/assets/index-D_DS0xgU.jsView on unpkg

dist/NodePtyAdapter-CHGVwPo2.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @dmccore/code@0.0.32-synaptic.7 matchedIdentity = npm:QGRtY2NvcmUvY29kZQ:0.0.32-synaptic.7 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/NodePtyAdapter-CHGVwPo2.mjsView on unpkg