@dmccore/code@0.0.40-synaptic.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@dmccore/code@0.0.40-synaptic.1: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/NodeServices-Bj0xFD_Q.mjsView file

6import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa... L7: import * as NodeChildProcess from "node:child_process"; L8: import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bj0xFD_Q.mjsView on unpkg · L6

6Cross-file remote execution chain: dist/NodeServices-Bj0xFD_Q.mjs spawns dist/Schema-DgWmtBPr.mjs; helper contains network access plus dynamic code execution. L6: import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa... L7: import * as NodeChildProcess from "node:child_process"; L8: import { PassThrough } from "node:stream"; ... L229: * operating-system processes. A spawner turns a command description into a L230: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L231: * the process, and manage whether the process keeps its parent alive. Platform ... L595: return callback(function loop(resume) { L596: for (; i < chunk.length;) if (!optio

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bj0xFD_Q.mjsView on unpkg · L6

dist/client/assets/typescript-S0auFSj_.jsView file

1import{a as e}from"./Icon-Bs5kt4yk.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse('{"displayName":"TypeScript","name":"typescript","patterns":[{"include":"#directives"},{... L2: //# sourceMappingURL=typescript-S0auFSj_.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/client/assets/typescript-S0auFSj_.jsView on unpkg · L1

dist/client/assets/ComposerPromptEditor-CbBtETqa.jsView file

5contains invisible/control Unicode U+200E (left-to-right mark) `,lt=We?`\xA0`:st,ut=`֑-߿יִ-﷽ﹰ-ﻼ`,dt=`A-Za-zÀ-ÖØ-öø-ʸ̀-֐ࠀ-῿<U+200E>Ⰰ-﬜︀-﹯﻽-`;RegExp(`^[^`+dt+`]*[`+ut+`]`),RegExp(`^[^`+ut+`]*[`+dt+`]`);var M={bold:1,capitalize:1024,code:16,highlight:128,italic:2,lowercase:256,strikethrough:4,subscript:32

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/ComposerPromptEditor-CbBtETqa.jsView on unpkg · L5

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 8828917 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 8828917 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/NodePtyAdapter-D_767uyO.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/NodePtyAdapter-gDftfLbP.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-D_767uyO.mjsView on unpkg

dist/BunPtyAdapter-LCaDIzTx.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-LCaDIzTx.mjsView on unpkg

Source & flagged code

9 flagged

dist/NodeServices-Bj0xFD_Q.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2

3import { n as __exportAll } from "./rolldown-runtime-BgTbyHMW.mjs";

4import { $i as runFork, $l as succeed$1, Aa as void_$1, Ar as catchCause, Ca as try_, Cu as getOrElse, Da as uninterruptibleMask, Do as addFinalizerExit, Ea as uninterruptible, Eo as addFinalizer, Er as asVoid, Fd as identity, Fu as some, Gu as Prototype, Ho as doneUnsafe, Ii as matchEffect, Jo as isDone, Kr as effectify, Kt as tag, Ld as pipe, Ll as of, Mu as match, Nd as dual, No as makeUnsafe, Nu as none, Oo as close, Pa as withFiber, Qa as catchDone, Rd as pipeArguments, Rr as catch_, Sa as tryPromise, Su as fromUndefinedOr, To as Scope, Ui as orDie, Xo as makeUnsafe$1, Yi as raceFirst, Yr ...

5import { $t as take, At as fromTransform, B as mkString, Ct as isSink, Gt as failCauseUnsafe, Ht as endUnsafe, Kt as make$11, Lt as makeUnsafe$2, N as isStream, S as fromChannel$1, St as fromChannel, X as run, Xt as poll, Yt as offerUnsafe, Z as runCollect, _t as unwrap, bt as drain, c as

6import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Path-C9g2CD3R.mjs";

7import * as NodeChildProcess from "node:child_process";

8import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-Bj0xFD_Q.mjsView on unpkg · L6

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-Bj0xFD_Q.mjsView on unpkg · L6

9import * as NodeCrypto from "node:crypto";

10import * as NFS from "node:fs";

11import * as OS from "node:os";

12import * as Path from "node:path";

13import * as NodeUrl from "node:url";

14import * as readline from "node:readline";

15//#region ../../node_modules/.pnpm/effect@4.0.0-rc.112_patch_hash=200b70758a8f02f5a4e6a4abea5f0079ad36fe9c2006486ebaf6ab1002a38320/node_modules/effect/dist/internal/rcRef.js

16const TypeId$4 = "~effect/RcRef";

17const stateEmpty = { _tag: "Empty" };

18const stateClosed = { _tag: "Closed" };

19const variance = {

20 _A: identity,

21 _E: identity

22};

23var RcRefImpl = class {

24 [TypeId$4] = variance;

25 pipe() {

26 return pipeArguments(this, arguments);

Long lines were clipped for display.

dist/client/assets/typescript-S0auFSj_.jsView file

Lines 1-2javascript

1import{a as e}from"./Icon-Bs5kt4yk.js";var t=e({default:()=>n}),n=[Object.freeze(JSON.parse('{"displayName":"TypeScript","name":"typescript","patterns":[{"include":"#directives"},{"include":"#statements"},{"include":"#shebang"}],"repository":{"access-modifier":{"match":"(?<![$_[:alnum:]])(?:(?<=\\\\

dist/client/assets/ComposerPromptEditor-CbBtETqa.jsView file

Lines 1-19javascript

1import{r as e,s as t}from"./Icon-Bs5kt4yk.js";import{$ as n,$i as r,Ji as i,W_ as a,r as o,t as s,tt as c}from"./utils-ygEXA1TB.js";import{t as

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 8828917 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 8828917 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/NodePtyAdapter-D_767uyO.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/NodePtyAdapter-gDftfLbP.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/NodePtyAdapter-D_767uyO.mjsView on unpkg

dist/BunPtyAdapter-LCaDIzTx.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-LCaDIzTx.mjsView on unpkg