@feedmepos/mf-inventory-portal@1.7.13-dev.0: Suspicious npm

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 108 file(s), 9.27 MB of source, external domains: api.github.com, blog.hackers-cafe.net, cdnjs.cloudflare.com, docs.oracle.com, edge.api.flagsmith.com, feature-flag-proxy.feedme.farm, feedme.ai, github.com, jspdf.default.namespaceuri, lodash.com, maps.googleapis.com, npm.pkg.github.com, npms.io, openjsf.org, openoffice.org, opensource.org, purl.oclc.org, purl.org, realtime.flagsmith.com, registry.npmjs.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, sheetjs.openxmlformats.org, tc39.es, underscorejs.org, webpjs.appspot.com, www.cs.cmu.edu, www.fpdf.org, www.myersdaily.org, www.pakpost.gov.pk, www.phpied.com, www.w3.org, www.yworks.com

Oversized source lightweight scan

dist/app-BqZSL5TH.js4.78 MB file, sampled 256 KB

HighEntropyStrings

Source & flagged code

6 flagged

dist/app-BqZSL5TH.jsView file

6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f); L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst... L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,... ... L121: usage: { L122: body: "Cannot delete {subject} because it is linked in these items:", L123: module: { ... L7773: else { L7774: if (n.charCodeAt(0) === 36) L7775: throw new Error("Unknown operation " + n); ... L8055: if (O && typeof O != "string") L8056: throw new Error("Ability.can expects 3rd

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/app-BqZSL5TH.jsView on unpkg · L6

6Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-BqZSL5TH.js L6: var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f); L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst... L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,... ... L121: usage: { L122: body: "Cannot delete {subject} because it is linked in these items:", L123: module: { ... L7773: else { L7774: if (n.charCodeAt(0) === 36) L7775: throw new Error("Unknown operation " + n); ... L8055:

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/app-BqZSL5TH.jsView on unpkg · L6

6Trigger-reachable credential exfiltration chain: manifest.module -> dist/app.js -> dist/app-BqZSL5TH.js L6: var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f); L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst... L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,... ... L121: usage: { L122: body: "Cannot delete {subject} because it is linked in these items:", L123: module: { ... L7773: else { L7774: if (n.charCodeAt(0) === 36) L7775: throw new Error("Unknown oper

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/app-BqZSL5TH.jsView on unpkg · L6

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/app-BqZSL5TH.jsView on unpkg

•path = dist/app-BqZSL5TH.js kind = oversized_source_file sizeBytes = 5009900 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/app-BqZSL5TH.jsView on unpkg

dist/inventory-core-dart.default-DWKWToqp.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @feedmepos/mf-inventory-portal@1.7.9-dev.0 matchedIdentity = npm:[redacted]:1.7.9-dev.0 similarity = 0.881 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/inventory-core-dart.default-DWKWToqp.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/app-BqZSL5TH.jsView file

6var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f); L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst... L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,... ... L121: usage: { L122: body: "Cannot delete {subject} because it is linked in these items:", L123: module: { ... L7773: else { L7774: if (n.charCodeAt(0) === 36) L7775: throw new Error("Unknown operation " + n); ... L8055: if (O && typeof O != "string") L8056: throw new Error("Ability.can expects 3rd

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/app-BqZSL5TH.jsView on unpkg · L6

6Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-BqZSL5TH.js L6: var pu = (p, g, f) => Lh(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || zc("Cannot " + f); L7: var Ce = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? zc("Cannot add the same private member more than once") : g inst... L8: import { isRef as Bh, ref as vi, shallowRef as Dh, watchEffect as Rh, computed as sn, h as qc, defineComponent as nm, createBlock as Vh, renderSlot as Ph, createCommentVNode as Nh,... ... L121: usage: { L122: body: "Cannot delete {subject} because it is linked in these items:", L123: module: { ... L7773: else { L7774: if (n.charCodeAt(0) === 36) L7775: throw new Error("Unknown operation " + n); ... L8055:

Findings

3 Critical2 High3 Medium6 Low

CriticalCredential Exfiltrationdist/app-BqZSL5TH.js

CriticalTrigger Reachable Dangerous Capabilitydist/app-BqZSL5TH.js

CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-DWKWToqp.js

HighTrigger Reachable Credential Exfiltrationdist/app-BqZSL5TH.js

HighSemantic Analysis Limiteddist/app-BqZSL5TH.js

MediumNetwork

MediumOversized Source Filedist/app-BqZSL5TH.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @feedmepos

Related packages

More from @feedmepos

Source & flagged code