@doubao-apps/cli@0.0.8: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@doubao-apps/cli@0.0.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

19 flagged · loading source

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.jsView file

15patternName = google_api_key severity = high line = 15 matchedText = var CRUX...gw";

High

High Secret

Package contains a high-severity secret pattern.

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.jsView on unpkg · L15

15patternName = google_api_key severity = high line = 15 matchedText = var CRUX...gw";

High

Secret Pattern

Google API key in dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.js

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/crux-manager.jsView on unpkg · L15

dist/305.jsView file

1import"node:module";import{spawn as e}from"node:child_process";import{fileURLToPath as r}from"node:url";import{execa as t}from"execa";import*as n from"node:fs";import*as i from"nod... L2: `,"utf8")}catch{}}function g(e){return!!process.env.DBX_CLI_NO_UPDATE_NOTIFIER||!!process.env.CI||!!process.env.BUILD_NUMBER||!!process.env.RUN_ID||!d(u(e))}async function S(e,r){l...

High

Child Process

Package source references child process execution.

dist/305.jsView on unpkg · L1

dist/assets/web-sdk-debugger/wsd/doubao-apps-react-dev.template.jsView file

1SDRAWROF|{"cardType":"react","isLazy":"true","enableFiberArch":"true","useLepusNG":"true"... L2: "use strict";var __webpack_modules__={76(){},727(t,n,r){r.r(n);var i=null,l=void 0,o=Array.isArray;function a(t,n){for(var r in n)t[r]=n[r];return t}var _=[].slice,s={__e:function(... L3:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/web-sdk-debugger/wsd/doubao-apps-react-dev.template.jsView on unpkg · L1

dist/@byted-doubao-apps/login.jsView file

1let e,t;import"node:module";import o from"node:fs/promises";import r from"node:os";import i from"node:path";import{error_getErrorMessage as n}from"../sdk.js";let s="pnpm --filter @... L2: ${d.map(e=>`- ${e}`).join("\n")}`:""].filter(Boolean).join("\n"))}async function N(e={}){let t=g(e.route),{targetUrl:o}=w[g(t)];return await C({route:t,targetUrl:o})||void 0}async ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/@byted-doubao-apps/login.jsView on unpkg · L1

dist/564.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @doubao-apps/cli@0.0.0-canary-6cbc77d-20260713124412 matchedIdentity = npm:QGRvdWJhby1hcHBzL2NsaQ:0.0.0-canary-6cbc77d-20260713124412 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/564.jsView on unpkg

1var e,t,r,n;let o,a;import{createRequire as i}from"node:module";import{Command as s,CommanderError as l,InvalidArgumentError as d}from"commander";import c from"chalk";import p from... L2: `)}async delete(e){try{await m.unlink(this.credentialFilePath(e))}catch(e){if(!F(e)||"ENOENT"!==e.code)throw new C(`Failed to delete encrypted token file: ${z(e)}`)}}masterKeyPath(...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/564.jsView on unpkg · L1

1var e,t,r,n;let o,a;import{createRequire as i}from"node:module";import{Command as s,CommanderError as l,InvalidArgumentError as d}from"commander";import c from"chalk";import p from... L2: `)}async delete(e){try{await m.unlink(this.credentialFilePath(e))}catch(e){if(!F(e)||"ENOENT"!==e.code)throw new C(`Failed to delete encrypted token file: ${z(e)}`)}}masterKeyPath(... L3: `),e}catch(e){if(F(e)&&"EEXIST"===e.code)return this.readMasterKey();throw new C(`Failed to write encrypted token master key: ${z(e)}`)}}}class H{async get(e){try{let{stdout:t}=awa... L4: `,{mode:384}),"win32"!==process.platform&&await m.chmod(o,384),await m.rename(o,e),"win32"!==process.platform&&await m.chmod(e,384)}async function Y(e,t={}){let r=await er(e);if(vo...

dist/@byted-doubao-open/dbx-auth-cli.jsView file

1import"node:module";import{__webpack_require__ as e}from"../rslib-runtime.js";import*as t from"node:child_process";import*as o from"node:crypto";import*as r from"node:fs";import*as... L2: `)}async delete(e){try{await a.promises.unlink(this.credentialFilePath(e))}catch(e){if(!E(e)||"ENOENT"!==e.code)throw new p(`Failed to delete encrypted token file: ${v(e)}`)}}maste... L3: `),e}catch(e){if(E(e)&&"EEXIST"===e.code)return this.readMasterKey();throw new p(`Failed to write encrypted token master key: ${v(e)}`)}}}class m{async get(e){try{let{stdout:t}=awa... L4: `,{mode:384}),"win32"!==process.platform&&await r.promises.chmod(i,384),await r.promises.rename(i,e),"win32"!==process.platform&&await r.promises.chmod(e,384)}async function c(e,t=... L5: //# sourceMappingURL=dbx-auth-cli.js.map

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/@byted-doubao-open/dbx-auth-cli.jsView on unpkg · L1

dist/bin/darwin-x64/security_tasm_codecView file

•path = dist/bin/darwin-x64/security_tasm_codec kind = native_binary sizeBytes = 15594616 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/bin/darwin-x64/security_tasm_codecView on unpkg

dist/assets/web-sdk-debugger/static/wasm/c3964f797a.module.wasmView file

•path = dist/assets/web-sdk-debugger/static/wasm/c3964f797a.module.wasm kind = wasm_module sizeBytes = 226246 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/web-sdk-debugger/static/wasm/c3964f797a.module.wasmView on unpkg

skills/doubao-miniapp-development/scripts/platform_info.pyView file

•path = skills/doubao-miniapp-development/scripts/platform_info.py kind = build_helper sizeBytes = 1915 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/doubao-miniapp-development/scripts/platform_info.pyView on unpkg

dist/assets/web-sdk-debugger/chrome-devtools/Images/chromeLeft.avifView file

•path = dist/assets/web-sdk-debugger/chrome-devtools/Images/chromeLeft.avif kind = high_entropy_blob sizeBytes = 6936 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/web-sdk-debugger/chrome-devtools/Images/chromeLeft.avifView on unpkg

dist/sdk.jsView file

•path = dist/sdk.js kind = oversized_source_file sizeBytes = 18980854 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/sdk.jsView on unpkg

dist/@byted-hdt/cli.jsView file

•path = dist/@byted-hdt/cli.js kind = oversized_cli_entrypoint sizeBytes = 4499164 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/@byted-hdt/cli.jsView on unpkg

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/CrUXManager.jsView file

19patternName = google_api_key severity = high line = 19 matchedText = const CR...gw';

High

Secret Pattern

Google API key in dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/CrUXManager.js

dist/assets/web-sdk-debugger/chrome-devtools/models/crux-manager/CrUXManager.jsView on unpkg · L19

skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.mdView file

78patternName = generic_password severity = medium line = 78 matchedText = wifiList...' }]

Medium

Secret Pattern

Hardcoded password in skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.md

skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.mdView on unpkg · L78

111patternName = generic_password severity = medium line = 111 matchedText = await co... });

Medium

Secret Pattern

Hardcoded password in skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.md

skills/doubao-miniapp-development/references/frontend/miniapp-api/15-wi-fi.mdView on unpkg · L111

skills/doubao-miniapp-development/references/server/openapi/security/signature-authentication-and-encryption.mdView file

473patternName = private_key_rsa severity = critical line = 473 matchedText = pem = pe... "")

Critical

Secret Pattern

RSA private key in skills/doubao-miniapp-development/references/server/openapi/security/signature-authentication-and-encryption.md

skills/doubao-miniapp-development/references/server/openapi/security/signature-authentication-and-encryption.mdView on unpkg · L473