@feedmepos/mf-inventory-portal@1.7.9: Suspicious npm security

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

Manifest

NoLicense

scanned 108 file(s), 9.19 MB of source, external domains: api.github.com, blog.hackers-cafe.net, cdnjs.cloudflare.com, docs.oracle.com, edge.api.flagsmith.com, feature-flag-proxy.feedme.farm, feedme.ai, github.com, jspdf.default.namespaceuri, lodash.com, maps.googleapis.com, npm.pkg.github.com, npms.io, openjsf.org, openoffice.org, opensource.org, purl.oclc.org, purl.org, realtime.flagsmith.com, registry.npmjs.org, schemas.microsoft.com, schemas.openxmlformats.org, sheetjs.com, sheetjs.openxmlformats.org, sms.feedmeapi.com, tc39.es, underscorejs.org, webpjs.appspot.com, www.cs.cmu.edu, www.fpdf.org, www.myersdaily.org, www.pakpost.gov.pk, www.phpied.com, www.w3.org, www.yworks.com

Oversized source lightweight scan

dist/app-CyTU8N3H.js4.72 MB file, sampled 256 KB

HighEntropyStrings

Source & flagged code

6 flagged

dist/app-CyTU8N3H.jsView file

6var pu = (p, g, f) => Ly(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f); L7: var be = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst... L8: import { isRef as Dy, ref as vi, shallowRef as By, watchEffect as Ry, computed as sn, h as q_, defineComponent as nm, createBlock as Vy, renderSlot as Py, createCommentVNode as Ny,... ... L40: usage: { L41: body: "Cannot delete {subject} because it is linked in these items:", L42: module: { ... L6880: else { L6881: if (n.charCodeAt(0) === 36) L6882: throw new Error("Unknown operation " + n); ... L7162: if (O && typeof O != "string") L7163: throw new Error("Ability.can expects 3rd par

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/app-CyTU8N3H.jsView on unpkg · L6

6Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-CyTU8N3H.js L6: var pu = (p, g, f) => Ly(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f); L7: var be = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst... L8: import { isRef as Dy, ref as vi, shallowRef as By, watchEffect as Ry, computed as sn, h as q_, defineComponent as nm, createBlock as Vy, renderSlot as Py, createCommentVNode as Ny,... ... L40: usage: { L41: body: "Cannot delete {subject} because it is linked in these items:", L42: module: { ... L6880: else { L6881: if (n.charCodeAt(0) === 36) L6882: throw new Error("Unknown operation " + n); ... L7162: if

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/app-CyTU8N3H.jsView on unpkg · L6

6Trigger-reachable credential exfiltration chain: manifest.module -> dist/app.js -> dist/app-CyTU8N3H.js L6: var pu = (p, g, f) => Ly(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f); L7: var be = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst... L8: import { isRef as Dy, ref as vi, shallowRef as By, watchEffect as Ry, computed as sn, h as q_, defineComponent as nm, createBlock as Vy, renderSlot as Py, createCommentVNode as Ny,... ... L40: usage: { L41: body: "Cannot delete {subject} because it is linked in these items:", L42: module: { ... L6880: else { L6881: if (n.charCodeAt(0) === 36) L6882: throw new Error("Unknown operati

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/app-CyTU8N3H.jsView on unpkg · L6

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/app-CyTU8N3H.jsView on unpkg

•path = dist/app-CyTU8N3H.js kind = oversized_source_file sizeBytes = 4944958 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/app-CyTU8N3H.jsView on unpkg

dist/inventory-core-dart.default-BgoK1eTS.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @feedmepos/mf-inventory-portal@1.7.9-dev.0 matchedIdentity = npm:[redacted]:1.7.9-dev.0 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/inventory-core-dart.default-BgoK1eTS.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/app-CyTU8N3H.jsView file

6var pu = (p, g, f) => Ly(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f); L7: var be = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst... L8: import { isRef as Dy, ref as vi, shallowRef as By, watchEffect as Ry, computed as sn, h as q_, defineComponent as nm, createBlock as Vy, renderSlot as Py, createCommentVNode as Ny,... ... L40: usage: { L41: body: "Cannot delete {subject} because it is linked in these items:", L42: module: { ... L6880: else { L6881: if (n.charCodeAt(0) === 36) L6882: throw new Error("Unknown operation " + n); ... L7162: if (O && typeof O != "string") L7163: throw new Error("Ability.can expects 3rd par

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/app-CyTU8N3H.jsView on unpkg · L6

6Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-CyTU8N3H.js L6: var pu = (p, g, f) => Ly(p, typeof g != "symbol" ? g + "" : g, f), $u = (p, g, f) => g.has(p) || z_("Cannot " + f); L7: var be = (p, g, f) => ($u(p, g, "read from private field"), f ? f.call(p) : g.get(p)), Ft = (p, g, f) => g.has(p) ? z_("Cannot add the same private member more than once") : g inst... L8: import { isRef as Dy, ref as vi, shallowRef as By, watchEffect as Ry, computed as sn, h as q_, defineComponent as nm, createBlock as Vy, renderSlot as Py, createCommentVNode as Ny,... ... L40: usage: { L41: body: "Cannot delete {subject} because it is linked in these items:", L42: module: { ... L6880: else { L6881: if (n.charCodeAt(0) === 36) L6882: throw new Error("Unknown operation " + n); ... L7162: if

Findings

3 Critical2 High3 Medium6 Low

CriticalCredential Exfiltrationdist/app-CyTU8N3H.js

CriticalTrigger Reachable Dangerous Capabilitydist/app-CyTU8N3H.js

CriticalPrevious Version Dangerous Deltadist/inventory-core-dart.default-BgoK1eTS.js

HighTrigger Reachable Credential Exfiltrationdist/app-CyTU8N3H.js

HighSemantic Analysis Limiteddist/app-CyTU8N3H.js

MediumNetwork

MediumOversized Source Filedist/app-CyTU8N3H.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @feedmepos

Related packages

More from @feedmepos

Source & flagged code