@dmccore/code@0.0.40-synaptic.2: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@dmccore/code@0.0.40-synaptic.2: Suspicious npm security report | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/NodeServices-bbWjF5St.mjsView file

6import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa... L7: import * as NodeChildProcess from "node:child_process"; L8: import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-bbWjF5St.mjsView on unpkg · L6

6Cross-file remote execution chain: dist/NodeServices-bbWjF5St.mjs spawns dist/Schema-2m1GwDpt.mjs; helper contains network access plus dynamic code execution. L6: import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Pa... L7: import * as NodeChildProcess from "node:child_process"; L8: import { PassThrough } from "node:stream"; ... L229: * operating-system processes. A spawner turns a command description into a L230: * handle that can write to stdin, read stdout and stderr, wait for exit, kill L231: * the process, and manage whether the process keeps its parent alive. Platform ... L595: return callback(function loop(resume) { L596: for (; i < chunk.length;) if (!optio

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-bbWjF5St.mjsView on unpkg · L6

dist/client/assets/utils-DwI2CmEH.jsView file

17contains invisible/control Unicode U+FEFF (zero width no-break space) `:o===`event`?l=p:o===`id`&&!p.includes(`\0`)?c=p:o===`retry`&&/^\d+$/.test(p)&&e(new GX({duration:li(parseInt(p,10)),lastEventId:c}))}}var HX=`<U+FEFF>`,UX=I({id:j(N),event:N,data:N}),WX=`~effect/encoding/Sse/Retry`,GX=class e extends ta(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/utils-DwI2CmEH.jsView on unpkg · L17

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 8837103 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 8837103 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/BunPtyAdapter-B-mgqTTB.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-B-mgqTTB.mjsView on unpkg

Source & flagged code

7 flagged

dist/NodeServices-bbWjF5St.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2

3import { n as __exportAll } from "./rolldown-runtime-BgTbyHMW.mjs";

4import { $i as runFork, $l as succeed$1, Aa as void_$1, Ar as catchCause, Ca as try_, Cu as getOrElse, Da as uninterruptibleMask, Do as addFinalizerExit, Ea as uninterruptible, Eo as addFinalizer, Er as asVoid, Fd as identity, Fu as some, Gu as Prototype, Ho as doneUnsafe, Ii as matchEffect, Jo as isDone, Kr as effectify, Kt as tag, Ld as pipe, Ll as of, Mu as match, Nd as dual, No as makeUnsafe, Nu as none, Oo as close, Pa as withFiber, Qa as catchDone, Rd as pipeArguments, Rr as catch_, Sa as tryPromise, Su as fromUndefinedOr, To as Scope, Ui as orDie, Xo as makeUnsafe$1, Yi as raceFirst, Yr ...

5import { B as mkString, Ct as fromChannel, J as pipeThroughChannelOrFail, Jt as offer, Kt as failCauseUnsafe, Mt as mapDone, N as isStream, Q as runCollect, Rt as makeUnsafe$2, S as fromChannel$1, Ut as endUnsafe, Xt as offerUnsafe, Z as run, Zt as poll, _n as runIn, at as splitLines, c as

6import { a as Size, c as BadArgument, d as systemError, i as FileTypeId, n as TypeId$5, o as WatchBackend, r as FileSystem, s as make$12, t as Path$1, u as badArgument } from "./Path-C4cbt8MI.mjs";

7import * as NodeChildProcess from "node:child_process";

8import { PassThrough } from "node:stream";

High

Child Process

Package source references child process execution.

dist/NodeServices-bbWjF5St.mjsView on unpkg · L6

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/NodeServices-bbWjF5St.mjsView on unpkg · L6

9import * as NodeCrypto from "node:crypto";

10import * as NFS from "node:fs";

11import * as OS from "node:os";

12import * as Path from "node:path";

13import * as NodeUrl from "node:url";

14import * as readline from "node:readline";

15//#region ../../node_modules/.pnpm/effect@4.0.0-rc.112_patch_hash=8bef799f35729cf3465eb428196f617b434a7c9f658d56acb2874d74b21b98b2/node_modules/effect/dist/internal/rcRef.js

16const TypeId$4 = "~effect/RcRef";

17const stateEmpty = { _tag: "Empty" };

18const stateClosed = { _tag: "Closed" };

19const variance = {

20 _A: identity,

21 _E: identity

22};

23var RcRefImpl = class {

24 [TypeId$4] = variance;

25 pipe() {

26 return pipeArguments(this, arguments);

Long lines were clipped for display.

dist/client/assets/utils-DwI2CmEH.jsView file

17contains invisible/control Unicode U+FEFF (zero width no-break space) `:o===`event`?l=p:o===`id`&&!p.includes(`\0`)?c=p:o===`retry`&&/^\d+$/.test(p)&&e(new GX({duration:li(parseInt(p,10)),lastEventId:c}))}}var HX=`<U+FEFF>`,UX=I({id:j(N),event:N,data:N}),WX=`~effect/encoding/Sse/Retry`,GX=class e extends ta(`

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/client/assets/utils-DwI2CmEH.jsView on unpkg · L17

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView file

•path = dist/client/assets/ghostty-vt-DdA0Zryv.wasm kind = wasm_module sizeBytes = 630932 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/client/assets/ghostty-vt-DdA0Zryv.wasmView on unpkg

dist/bin.mjsView file

•path = dist/bin.mjs kind = oversized_source_file sizeBytes = 8837103 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/bin.mjsView on unpkg

•path = dist/bin.mjs kind = oversized_cli_entrypoint sizeBytes = 8837103 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/bin.mjsView on unpkg

dist/BunPtyAdapter-B-mgqTTB.mjsView file

•matchType = normalized_sha256 matchedPackage = @verne-build/cli@0.0.37 matchedPath = dist/BunPtyAdapter-VCmyFG3E.mjs matchedIdentity = npm:QHZlcm5lLWJ1aWxkL2NsaQ:0.0.37 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/BunPtyAdapter-B-mgqTTB.mjsView on unpkg