@feedmepos/mf-payment@1.11.6: Malicious npm security report | LPM Firewall

Loading npm security reports…

@feedmepos/mf-payment@1.11.6: Malicious npm security report | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = pnpm -C ../package install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = pnpm -C ../package install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/app-rcbXu2mv.jsView file

19173patternName = google_api_key severity = high line = 19173

High

High Secret

Package contains a high-severity secret pattern.

dist/app-rcbXu2mv.jsView on unpkg · L19173

19173patternName = google_api_key severity = high line = 19173

High

Secret Pattern

Google API key in dist/app-rcbXu2mv.js

dist/app-rcbXu2mv.jsView on unpkg · L19173

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView file

18363contains invisible/control Unicode U+2068 (first strong isolate) const lh = 100, EJ = "<U+2068>", wJ = "<U+2069>";

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView on unpkg · L18363

•Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-rcbXu2mv.js -> dist/OnboardForm-DCviWRUg.js -> dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView on unpkg

790try { L791: return Function('return require("' + F + '")')(); L792: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView on unpkg · L790

dist/OnboardForm-CJ6ziPRG.jsView file

•path = dist/OnboardForm-CJ6ziPRG.js kind = oversized_source_file sizeBytes = 19188953 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/OnboardForm-CJ6ziPRG.jsView on unpkg

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 77-112json

77 "@vue/test-utils": "^2.4.1",

78 "@vue/vue3-jest": "^29.2.5",

79 "autoprefixer": "^10.4.20",

80 "cd": "^0.3.3",

81 "eslint": "^8.17.0",

82 "eslint-plugin-vue": "^9.1.0",

83 "jest": "^29.6.3",

84 "jest-environment-jsdom": "^29.4.1",

85 "jest-transform-stub": "^2.0.0",

86 "path": "^0.12.7",

87 "postcss": "^8.4.47",

88 "sass": "1.32.12",

89 "tailwindcss": "^3.4.14",

90 "ts-jest": "^29.1.1",

91 "ts-node": "^10.9.1",

92 "typescript": "~5.4.0",

93 "vite": "^5.2.11",

94 "vue-tsc": "^2.0.11"

95 },

96 "scripts": {

97 "postinstall": "pnpm -C ../package install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L97

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L97

98 "lint": "eslint --ext .ts,vue --ignore-path .gitignore . --fix",

99 "dev": "vite --mode dev",

100 "prod": "vite --mode prod",

101 "preview": "vite preview",

102 "test": "jest",

103 "build:dts": "vue-tsc --declaration --emitDeclarationOnly -p tsconfig.app.json --outDir ./dist && mv ./dist/src/* dist",

104 "build-types": "vue-tsc --declaration --emitDeclarationOnly -p tsconfig.app.json --outDir dist --composite false",

105 "build:mf:dev": "vite build --mode fmmf:dev",

106 "build:mf:prod": "vite build --mode fmmf:prod",

107 "build:dev": "pnpm build:mf:dev && pnpm build:dts && pnpm build-types && cp package.json ./dist",

108 "build:prod": "pnpm build:mf:prod && pnpm build:dts && pnpm build-types && cp package.json ./dist",

109 "deploy:dev": "npm publish --@feedmepos:registry=https://registry.npmjs.org/ --access public --tag beta --no-git-checks .",

110 "deploy:prod": "npm publish --@feedmepos:registry=https://registry.npmjs.org/ --access public --tag beta --no-git-checks ."

111 }

112}

dist/app-rcbXu2mv.jsView file

19173patternName = google_api_key severity = high line = 19173

High

High Secret

Package contains a high-severity secret pattern.

dist/app-rcbXu2mv.jsView on unpkg · L19173

19173patternName = google_api_key severity = high line = 19173

High

Secret Pattern

Google API key in dist/app-rcbXu2mv.js

dist/app-rcbXu2mv.jsView on unpkg · L19173

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView file

18363contains invisible/control Unicode U+2068 (first strong isolate) const lh = 100, EJ = "<U+2068>", wJ = "<U+2069>";

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView on unpkg · L18363

•Trigger-reachable chain: manifest.module -> dist/app.js -> dist/app-rcbXu2mv.js -> dist/OnboardForm-DCviWRUg.js -> dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView on unpkg

790try { L791: return Function('return require("' + F + '")')(); L792: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/DocumentViewer.vue_vue_type_script_setup_true_lang-6aVaeAEW.jsView on unpkg · L790

dist/OnboardForm-CJ6ziPRG.jsView file

•path = dist/OnboardForm-CJ6ziPRG.js kind = oversized_source_file sizeBytes = 19188953 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/OnboardForm-CJ6ziPRG.jsView on unpkg

dist/style.cssView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/style.cssView on unpkg