@dotobokuri/fleet-console@1.96.1: Manual Review npm security | LPM Firewall

Loading npm security reports…

@dotobokuri/fleet-console@1.96.1: Manual Review npm security | LPM Firewall

Source & flagged code

23 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/fleet.mjsView file

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, spawnSync, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs33, { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path2

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/fleet.mjsView on unpkg · L8

9import http from 'node:http'; L10: import { execFile as execFile$1, spawn, spawnSync, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module';

High

Child Process

Package source references child process execution.

dist/fleet.mjsView on unpkg · L9

130return { L131: bin: env.ComSpec ?? "cmd.exe", L132: prefixArgs: ["/d", "/s", "/c", "call", forceWindowsArgQuoting(resolved)]

High

Shell

Package source references shell execution.

dist/fleet.mjsView on unpkg · L130

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, spawnSync, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs33, { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/fleet.mjsView on unpkg · L8

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, spawnSync, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs33, { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path2

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/fleet.mjsView on unpkg · L8

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/fleet.mjsView on unpkg

8import crypto13, { randomUUID, createHash as createHash$1 } from 'node:crypto'; L9: import http from 'node:http'; L10: import { execFile as execFile$1, spawn, spawnSync, execFileSync } from 'node:child_process'; L11: import { createRequire, builtinModules } from 'node:module'; ... L22: import http2 from 'http2'; L23: import { deflateRawSync, inflateRawSync } from 'zlib'; L24: import V2, { stdin, stdout } from 'node:process'; L25: import fs33, { mkdir as mkdir$1, readdir, readFile, stat as stat$1, writeFile, rm, appendFile as appendFile$1, realpath, lstat, rename, open, mkdtemp } from 'node:fs/promises'; ... L71: )); L72: function getFleetDataDir(env = process.env) { L73: const override = env[FLEET_DATA_DIR_ENV]; L74: if (override === void 0 || override.trim().length === 0) return path2

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/fleet.mjsView on unpkg · L8

dist/cli.mjsView file

6Trigger-reachable chain: manifest.main -> dist/cli.mjs L6: import { fileURLToPath, pathToFileURL } from 'node:url'; L7: import { execFile as execFile$1, spawn, spawnSync, execFileSync } from 'node:child_process'; L8: import { performance as performance$1 } from 'node:perf_hooks'; ... L22: import { promisify } from 'util'; L23: import http2 from 'http2'; L24: import { deflateRawSync, inflateRawSync } from 'zlib'; L25: import fs33, { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; ... L65: const resolved = findBinaryPath(command2, env, options); L66: return resolved ? wrapWindowsShim(resolved, env, options.platform ?? process.platform) : void 0; L67: } ... L94: return { L95: bin: env.ComSpec ?? "cmd.exe",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.mjsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.mjs: import fs20__default, { existsSync, readFileSync, promises, constants as constants$1, realpathSync, accessSync, lstatSync, rmSync, mkdirSync, mkdtempSync, writeFileSync, chmodSync,... import fs33, { mkdir, readdir, readFile, rm, writeFile, open, mkdtemp, rename } from 'node:fs/promises'; import readline from 'node:readline'; headers: { Authorization: `Bearer ${lock.token}` }, fsImpl.writeFileSync(fd, `${JSON.stringify(payload, null, 2)} fs20.writeFileSync(tempPath, content, { encoding: "utf-8", flag: "wx", mode }); fs20.writeFileSync(ownerPath, JSON.stringify(owner), { encoding: "utf-8", mode: 384 }); const claudeCodeSyst

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.mjsView on unpkg

dist/fleet-plugins/file-explorer/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/file-explorer/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/file-explorer/routes.mjsView on unpkg

dist/fleet-plugins/ledger/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/ledger/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/ledger/routes.mjsView on unpkg

dist/fleet-plugins/codex/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/codex/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/codex/routes.mjsView on unpkg

dist/fleet-plugins/quota/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/quota/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/quota/routes.mjsView on unpkg

dist/fleet-plugins/repository/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/repository/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/repository/routes.mjsView on unpkg

dist/fleet-plugins/skills/routes.mjsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/fleet-plugins/skills/routes.mjs matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/fleet-plugins/skills/routes.mjsView on unpkg

dist/client/assets/chunk-OYMX7WX6-Ce9XdPLR.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/chunk-OYMX7WX6-DdYYHE30.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/chunk-OYMX7WX6-Ce9XdPLR.jsView on unpkg

dist/client/assets/diagram-G4DWMVQ6-_1KGjv6O.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/diagram-G4DWMVQ6-6pi0pIEd.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/diagram-G4DWMVQ6-_1KGjv6O.jsView on unpkg

dist/client/assets/flowDiagram-DWJPFMVM-De_b7vDI.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/flowDiagram-DWJPFMVM-De_b7vDI.jsView on unpkg

dist/client/assets/wardleyDiagram-NUSXRM2D-BpMpHTCT.jsView file

•matchType = normalized_sha256 matchedPackage = @dotobokuri/fleet-console@1.90.0 matchedPath = [redacted]-NUSXRM2D-0zWurJwJ.js matchedIdentity = npm:[redacted]:1.90.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/client/assets/wardleyDiagram-NUSXRM2D-BpMpHTCT.jsView on unpkg