@fleetbo/svro@0.0.9: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@fleetbo/svro@0.0.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/postinstall.js || node ./scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/postinstall.js || node ./scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

2#!/usr/bin/env node L3: var v=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var A=(t,n,o)=>()=>{if(o)throw o[0];try{ret... L4: `),r(`\u2192 ${p.basename(i)} ${s?"cr\xE9\xE9":"mis \xE0 jour"} : checkJs/jsx/types configur\xE9s.`),r(' \u26A0\uFE0F Rechargez votre \xE9diteur si les changements ne sont pas pr... ... L23: const path = require('path'); L24: const { execSync } = require('child_process'); L25: const schemaPath = path.join(process.cwd(), 'svro.schema.json'); L26: fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); ... L29: res.writeHead(200, { 'Content-Type': 'application/json' }); L30: res.end(JSON.stringify({ success: true })); L31: } catch (e) { ... L41: },`+s.slice(a)}}i

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/postinstall.jsView on unpkg · L2

26fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L27: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L28: } L29: res.writeHead(200, { 'Content-Type': 'application/json' }); L30: res.end(JSON.stringify({ success: true })); L31: } catch (e) { ... L41: },`+s.slice(a)}}if(s!==i)try{l.writeFileSync(c,s),r(`\u2192 ${p.basename(c)} patch\xE9 : plugins AutoImport & Fleetbo Schema Sync configur\xE9s.`)}catch{r("\u2192 \xC9chec de l'\xE... L42: `),r("\u2192 package.json mis \xE0 jour : unplugin-auto-import ajout\xE9 aux devDependencies."),r(" \u26A0\uFE0F Relancez `npm install` une fois pour installer le paquet ajout\xE... L43: VITE_FLEETBO_DB_KEY=${e.dbKey}

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/postinstall.jsView on unpkg · L26

2Trigger-reachable chain: scripts.postinstall -> dist/postinstall.js L2: #!/usr/bin/env node L3: var v=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var w=Object.getOwnPropertyNames;var R=Object.prototype.hasOwnProperty;var A=(t,n,o)=>()=>{if(o)throw o[0];try{ret... L4: `),r(`\u2192 ${p.basename(i)} ${s?"cr\xE9\xE9":"mis \xE0 jour"} : checkJs/jsx/types configur\xE9s.`),r(' \u26A0\uFE0F Rechargez votre \xE9diteur si les changements ne sont pas pr... ... L23: const path = require('path'); L24: const { execSync } = require('child_process'); L25: const schemaPath = path.join(process.cwd(), 'svro.schema.json'); L26: fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); ... L29: res.writeHead(200, { 'Content-Type': 'application/json' }); L30: res.end(JSON.stringif

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/postinstall.jsView on unpkg · L2

23const path = require('path'); L24: const { execSync } = require('child_process'); L25: const schemaPath = path.join(process.cwd(), 'svro.schema.json');

High

Child Process

Package source references child process execution.

dist/postinstall.jsView on unpkg · L23

26fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L27: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L28: } ... L41: },`+s.slice(a)}}if(s!==i)try{l.writeFileSync(c,s),r(`\u2192 ${p.basename(c)} patch\xE9 : plugins AutoImport & Fleetbo Schema Sync configur\xE9s.`)}catch{r("\u2192 \xC9chec de l'\xE... L42: `),r("\u2192 package.json mis \xE0 jour : unplugin-auto-import ajout\xE9 aux devDependencies."),r(" \u26A0\uFE0F Relancez `npm install` une fois pour installer le paquet ajout\xE... L43: VITE_FLEETBO_DB_KEY=${e.dbKey}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/postinstall.jsView on unpkg · L26

26fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L27: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L28: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/postinstall.jsView on unpkg · L26