@doubao-apps/cli@0.0.0-canary-6cbc77d-20260713124412: Suspicious | LPM Firewall

Loading npm security reports…

@doubao-apps/cli@0.0.0-canary-6cbc77d-20260713124412: Suspicious | LPM Firewall

Source & flagged code

17 flagged · loading source

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.jsView file

15patternName = google_api_key severity = high line = 15 matchedText = var CRUX...gw";

High

High Secret

Package contains a high-severity secret pattern.

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.jsView on unpkg · L15

15patternName = google_api_key severity = high line = 15 matchedText = var CRUX...gw";

High

Secret Pattern

Google API key in dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.js

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.jsView on unpkg · L15

dist/@byted-doubao-apps/create.jsView file

1import e from"node:path";import t,{promises as a}from"node:fs";import{execFileSync as r}from"node:child_process";import{fileURLToPath as o}from"node:url";let i=e.join("src","app.co... L2: `}return"README.md"===e||"AGENTS.md"===e?b(t).split("\n").filter(e=>!y.some(t=>e.includes(t))).join("\n"):b(t)}(i.name,s,r))}}async function h(a,r){let o=e.join(a,"package.json");i...

High

Child Process

Package source references child process execution.

dist/@byted-doubao-apps/create.jsView on unpkg · L1

dist/assets/web-sdk-debugger/wsd/doubao-apps-react-dev.template.jsView file

1SDRAWROF|{"cardType":"react","isLazy":"true","enableFiberArch":"true","useLepusNG":"true"... L2: "use strict";var __webpack_modules__={76(){},609(t,n,r){r.r(n);var i=null,l=void 0,o=Array.isArray;function a(t,n){for(var r in n)t[r]=n[r];return t}var _=[].slice,s={__e:function(... L3:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/web-sdk-debugger/wsd/doubao-apps-react-dev.template.jsView on unpkg · L1

dist/@byted-doubao-apps/login.jsView file

1let e,t;import o from"node:fs/promises";import r from"node:os";import i from"node:path";import{error_getErrorMessage as n}from"../sdk.js";let s="pnpm --filter @byted-doubao-apps/lo... L2: ${d.map(e=>`- ${e}`).join("\n")}`:""].filter(Boolean).join("\n"))}async function N(e={}){let t=g(e.route),{targetUrl:o}=w[g(t)];return await C({route:t,targetUrl:o})||void 0}async ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/@byted-doubao-apps/login.jsView on unpkg · L1

dist/dev-service-client.jsView file

1/*! LICENSE: dev-service-client.js.LICENSE.txt */ L2: let e,t;import{fileURLToPath as s,pathToFileURL as r}from"node:url";import{lstatSync as i,readdir as o,readdirSync as n,readlinkSync as l,realpathSync as a}from"fs";import"path";im... L3: `)}t.LdtMultiOpenCallback=class{constructor(e){this.driverClient=e}statusChanged(e){if(e===r.MultiOpenStatus.unattached){i("[connection-core] MultiOpen: switch to unattached"),this... ... L16: ${r} L17: `)}return t},generateDetails(e){let t=[],s=[].concat("string"==typeof e?this.details[e]:e);for(let e=0,r=s.length;e<r;e++)t.push(Object.assign({},s[e]));let r=[],i="commands"===e;f... L18: return value;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev-service-client.jsView on unpkg · L1

1/*! LICENSE: dev-service-client.js.LICENSE.txt */ L2: let e,t;import{fileURLToPath as s,pathToFileURL as r}from"node:url";import{lstatSync as i,readdir as o,readdirSync as n,readlinkSync as l,realpathSync as a}from"fs";import"path";im... L3: `)}t.LdtMultiOpenCallback=class{constructor(e){this.driverClient=e}statusChanged(e){if(e===r.MultiOpenStatus.unattached){i("[connection-core] MultiOpen: switch to unattached"),this...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/dev-service-client.jsView on unpkg · L1

dist/@byted-doubao-open/dbx-auth-cli.jsView file

1import{__webpack_require__ as e}from"../38.js";import*as t from"node:child_process";import*as o from"node:crypto";import*as r from"node:fs";import*as n from"node:os";import*as a fr... L2: `)}async delete(e){try{await a.promises.unlink(this.credentialFilePath(e))}catch(e){if(!E(e)||"ENOENT"!==e.code)throw new p(`Failed to delete encrypted token file: ${v(e)}`)}}maste... L3: `),e}catch(e){if(E(e)&&"EEXIST"===e.code)return this.readMasterKey();throw new p(`Failed to write encrypted token master key: ${v(e)}`)}}}class m{async get(e){try{let{stdout:t}=awa... L4: `,{mode:384}),"win32"!==process.platform&&await r.promises.chmod(i,384),await r.promises.rename(i,e),"win32"!==process.platform&&await r.promises.chmod(e,384)}async function c(e,t=... L5: //# sourceMappingURL=dbx-auth-cli.js.map

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/@byted-doubao-open/dbx-auth-cli.jsView on unpkg · L1

dist/assets/web-sdk-debugger/static/wasm/c3964f797a.module.wasmView file

•path = dist/assets/web-sdk-debugger/static/wasm/c3964f797a.module.wasm kind = wasm_module sizeBytes = 226246 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/web-sdk-debugger/static/wasm/c3964f797a.module.wasmView on unpkg

skills/doubao-miniapp-development/scripts/platform_info.pyView file

•path = skills/doubao-miniapp-development/scripts/platform_info.py kind = build_helper sizeBytes = 1918 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/doubao-miniapp-development/scripts/platform_info.pyView on unpkg

dist/assets/web-sdk-debugger/chrome-devtools/Images/chromeLeft.avifView file

•path = dist/assets/web-sdk-debugger/chrome-devtools/Images/chromeLeft.avif kind = high_entropy_blob sizeBytes = 6936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/web-sdk-debugger/chrome-devtools/Images/chromeLeft.avifView on unpkg

dist/sdk.jsView file

•path = dist/sdk.js kind = oversized_source_file sizeBytes = 18952591 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/sdk.jsView on unpkg

dist/@byted-hdt/cli.jsView file

•path = dist/@byted-hdt/cli.js kind = oversized_cli_entrypoint sizeBytes = 4498553 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/@byted-hdt/cli.jsView on unpkg

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/CrUXManager.jsView file

19patternName = google_api_key severity = high line = 19 matchedText = const CR...gw';

High

Secret Pattern

Google API key in dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/CrUXManager.js

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/CrUXManager.jsView on unpkg · L19

skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.mdView file

78patternName = generic_password severity = medium line = 78 matchedText = wifiList...' }]

Medium

Secret Pattern

Hardcoded password in skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.md

skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.mdView on unpkg · L78

111patternName = generic_password severity = medium line = 111 matchedText = await co... });

Medium

Secret Pattern

Hardcoded password in skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.md

skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.mdView on unpkg · L111

skills/doubao-miniapp-development/references/server/openapi/security/signature-authentication-and-encryption.mdView file

416patternName = private_key_rsa severity = critical line = 416 matchedText = pem = pe... "")

Critical

Secret Pattern

RSA private key in skills/doubao-miniapp-development/references/server/openapi/security/signature-authentication-and-encryption.md

skills/doubao-miniapp-development/references/server/openapi/security/signature-authentication-and-encryption.mdView on unpkg · L416