@explorer02/cfm-survey-sdk: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@explorer02/cfm-survey-sdk: Suspicious npm security report (Warn) | LPM Firewall

dist/cli/index.jsView file

1#!/usr/bin/env node L2: "use strict";var Vi=Object.create;var yn=Object.defineProperty;var Xi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Wi=Object.getPrototypeOf,Yi=Object.proto... L3:

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

223`),process.exit(1))):(console.log(` L224: \u274C ${p.red}winget package manager is not installed on this system.${p.reset}`),console.log(`${p.bold}\u{1F449} To proceed, please either:${p.reset}`),console.log(" 1. Install... L225: `),process.exit(1)):o?Pe("brew")?(console.log(` ... L230: `),process.exit(1))):(console.log(` L231: \u274C ${p.red}Homebrew package manager (brew) is not installed on this system.${p.reset}`),console.log(`${p.bold}\u{1F449} To proceed, please either:${p.reset}`),console.log(" 1... L232: `),process.exit(1)):(console.log(` ... L237: \u26A0\uFE0F ${p.yellow}Global installation failed or permissions restricted.${p.reset}`),console.log(`\u2139 ${p.dim}Falling back: Running Vercel dynamically via npx.${p.reset}`)... L238: ${p.dim}Step 3/4: Checking Vercel Log

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L223

1#!/usr/bin/env node L2: "use strict";var Vi=Object.create;var yn=Object.defineProperty;var Xi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Wi=Object.getPrototypeOf,Yi=Object.proto... L3: ... L66: L67: Example reply: "yes, AWS", "yes, Sprinklr", or "no"`,rs="CFM_NEXT_STEP=ASK_DEPLOY"});function ps(e){return us.join(e,da)}function ds(){return process.env.CFM_SKIP_WORKFLOW_GATE==="... L68: `,"utf8")}function fs(e){let t=Ie(e);wt(e,{version:1,coreVerifyPassedAt:new Date().toISOString(),layoutVerifyPassedAt:t?.layoutVerifyPassedAt??null,deployConfirmed:t?.deployConfirm... L69: `).length}function Lt(e,t,n){let s=new Set;if(t==="fastPath"){let o=e.fastPath;for(let r of o?.read??[])s.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(i=>String(i.i... ... L7

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var Vi=Object.create;var yn=Object.defineProperty;var Xi=Object.getOwnPropertyDescriptor;var Ki=Object.getOwnPropertyNames;var Wi=Object.getPrototypeOf,Yi=Object.prototype.hasOwnProperty;var f=(e,t)=>()=>(e&&(t=e(e=0)),t);var re=(e,t)=>{for(var n in t)yn(e,n,{get:t[n],enumerable:!0})},zi=(e,t,n,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of Ki(t))!Yi.call(e,o)&&o!==n&&yn(e,o,{get:()=>t[o],enumerable:!(s=Xi(t,o))||s.enumerable});return e};var I=(e,t,n)=>(n=e!=null?Vi(Wi(e)):{},zi(t||!e||!e.__esModule?yn(n,"default",{value:e,enumerable:!0}):n,e));var p,Ct,$=f(()=>{ ...

3

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

4I've set everything up on my side. You just need to generate a short code in our distribution dashboard \u2014 then paste it back to me and I'll publish the link.

5

6| | |

7|---|---|

8| **Your Survey ID** | \`${e}\` |

9| **Open this dashboard** | ${Ct} |

10

11**What to do:**

121. Open the dashboard link above

132. Click **Create distribution**

143. Paste your **Survey ID** from the table and click **Generate key**

154. Copy the key that appears (a short code like \`a3f91c2e8b4d7016\`)

165. Paste that key in your next message here

17

18**What happens next:** I'll publish your live survey link and send it to you in this chat.

19

20*(You don't need to click Deploy in the dashboard \u2014 I'll handle that once you send me the key.)*`}function ra(e){return`Done! Your survey is live.

21

Long lines were clipped for display.

Lines 203-243javascript

203${as(d)}

204`),0}var S,_i=f(()=>{"use strict";$();dn();$e();on();ae();Ae();Ve();Ue();S=p});var Ni={};re(Ni,{runVerifyInteractions:()=>zu});function zu(e={}){let t=D(e.projectRoot);console.log(`${Z.bold}=== CFM SDK \u2014 verify-interactions ===${Z.reset}`),console.log(`${Z.dim}Project: ${t}${Z.reset}

205