@feedmepos/mf-payment@1.10.1: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@feedmepos/mf-payment@1.10.1: Suspicious npm security report | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = pnpm -C ../package install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = pnpm -C ../package install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/app-_eJTNh14.jsView file

11353patternName = google_api_key severity = high line = 11353 matchedText = var nd =...} };

High

High Secret

Package contains a high-severity secret pattern.

dist/app-_eJTNh14.jsView on unpkg · L11353

11353patternName = google_api_key severity = high line = 11353 matchedText = var nd =...} };

High

Secret Pattern

Google API key in dist/app-_eJTNh14.js

dist/app-_eJTNh14.jsView on unpkg · L11353

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView file

18363contains invisible/control Unicode U+2068 (first strong isolate) const lh = 100, EJ = "<U+2068>", wJ = "<U+2069>";

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView on unpkg · L18363

•Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-_eJTNh14.js -> dist/PayoutAccount-CSZugVuH.js -> dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView on unpkg

790try { L791: return Function('return require("' + F + '")')(); L792: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView on unpkg · L790

dist/OnboardForm-BsGjofaE.jsView file

•path = dist/OnboardForm-BsGjofaE.js kind = oversized_source_file sizeBytes = 7555118 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/OnboardForm-BsGjofaE.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 77-112json

77 "@vue/test-utils": "^2.4.1",

78 "@vue/vue3-jest": "^29.2.5",

79 "autoprefixer": "^10.4.20",

80 "cd": "^0.3.3",

81 "eslint": "^8.17.0",

82 "eslint-plugin-vue": "^9.1.0",

83 "jest": "^29.6.3",

84 "jest-environment-jsdom": "^29.4.1",

85 "jest-transform-stub": "^2.0.0",

86 "path": "^0.12.7",

87 "postcss": "^8.4.47",

88 "sass": "1.32.12",

89 "tailwindcss": "^3.4.14",

90 "ts-jest": "^29.1.1",

91 "ts-node": "^10.9.1",

92 "typescript": "~5.4.0",

93 "vite": "^5.2.11",

94 "vue-tsc": "^2.0.11"

95 },

96 "scripts": {

97 "postinstall": "pnpm -C ../package install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L97

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L97

98 "lint": "eslint --ext .ts,vue --ignore-path .gitignore . --fix",

99 "dev": "vite --mode dev",

100 "prod": "vite --mode prod",

101 "preview": "vite preview",

102 "test": "jest",

103 "build:dts": "vue-tsc --declaration --emitDeclarationOnly -p tsconfig.app.json --outDir ./dist && mv ./dist/src/* dist",

104 "build-types": "vue-tsc --declaration --emitDeclarationOnly -p tsconfig.app.json --outDir dist --composite false",

105 "build:mf:dev": "vite build --mode fmmf:dev",

106 "build:mf:prod": "vite build --mode fmmf:prod",

107 "build:dev": "pnpm build:mf:dev && pnpm build:dts && pnpm build-types && cp package.json ./dist",

108 "build:prod": "pnpm build:mf:prod && pnpm build:dts && pnpm build-types && cp package.json ./dist",

109 "deploy:dev": "npm publish --@feedmepos:registry=https://registry.npmjs.org/ --access public --tag beta --no-git-checks .",

110 "deploy:prod": "npm publish --@feedmepos:registry=https://registry.npmjs.org/ --access public --tag beta --no-git-checks ."

111 }

112}

dist/app-_eJTNh14.jsView file

11353patternName = google_api_key severity = high line = 11353 matchedText = var nd =...} };

High

High Secret

Package contains a high-severity secret pattern.

dist/app-_eJTNh14.jsView on unpkg · L11353

11353patternName = google_api_key severity = high line = 11353 matchedText = var nd =...} };

High

Secret Pattern

Google API key in dist/app-_eJTNh14.js

dist/app-_eJTNh14.jsView on unpkg · L11353

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView file

18363contains invisible/control Unicode U+2068 (first strong isolate) const lh = 100, EJ = "<U+2068>", wJ = "<U+2069>";

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView on unpkg · L18363

•Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-_eJTNh14.js -> dist/PayoutAccount-CSZugVuH.js -> dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView on unpkg

790try { L791: return Function('return require("' + F + '")')(); L792: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-BA0tliZY.jsView on unpkg · L790

dist/OnboardForm-BsGjofaE.jsView file

•path = dist/OnboardForm-BsGjofaE.js kind = oversized_source_file sizeBytes = 7555118 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/OnboardForm-BsGjofaE.jsView on unpkg