@genex-ai/cli-demo@0.60.0: Suspicious npm security report (Warn)

Loading npm security reports…

@genex-ai/cli-demo@0.60.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3// src/instrument.ts

4import * as Sentry from "@sentry/node";

6// src/config.ts

7import fs from "fs";

8import os from "os";

9import path from "path";

10import { fileURLToPath } from "url";

11var RAW_CHANNEL = "latest";

12var CLI_CHANNEL = RAW_CHANNEL === "dev" ? "dev" : "latest";

13var STANDS = {

14 prod: { api: "https://api.genex.games", dashboard: "https://genex.games" },

15 dev: { api: "https://api-dev.genex.games", dashboard: "https://dev.genex.games" }

16};

17var DEFAULT_AUTH_URL = CLI_CHANNEL === "dev" ? STANDS.dev.dashboard : STANDS.prod.dashboard;

18var DEFAULT_API_URL = CLI_CHANNEL === "dev" ? STANDS.dev.api : STANDS.prod.api;

19var DEFAULT_ANIMS_BASE = "https://cdn.genex.technology/anims/ual1/v1/";

20var ANIMS_BASE_ENV = "GENEX_ANIMS_BASE";

21function getAnimsBase(override) {

22 const raw = override || process.env[ANIMS_BASE_ENV] || DEFAULT_ANIMS_BASE;

23 return raw.replace(/\/+$/, "") + "/";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L13

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L13

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L13

24}

25function getAnimsCacheDir() {

26 return path.join(getGenexDir(), "cache", "anims");

27}

28var ENV_TOKEN_KEY = "GENEX_TOKEN";

29var AUTH_URL_ENV = "GENEX_AUTH_URL";

30var API_URL_ENV = "GENEX_API_URL";

31var ENV_FILE_ENV = "GENEX_ENV_FILE";

32function getAuthUrl(override) {

33 const raw = override || process.env[AUTH_URL_ENV] || DEFAULT_AUTH_URL;

Source & flagged code

3 flagged · loading source

dist/index.jsView file

13var STANDS = { L14: prod: { api: "https://api.genex.games", dashboard: "https://genex.games" }, L15: dev: { api: "https://api-dev.genex.games", dashboard: "https://dev.genex.games" } ... L21: function getAnimsBase(override) { L22: const raw = override || process.env[ANIMS_BASE_ENV] || DEFAULT_ANIMS_BASE; L23: return raw.replace(/\/+$/, "") + "/"; ... L40: function getGenexDir() { L41: return path.join(os.homedir(), ".genex"); L42: } ... L55: const here = path.dirname(fileURLToPath(import.meta.url)); L56: const pkg = JSON.parse( L57: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L13

13Trigger-reachable chain: manifest.bin -> dist/index.js L13: var STANDS = { L14: prod: { api: "https://api.genex.games", dashboard: "https://genex.games" }, L15: dev: { api: "https://api-dev.genex.games", dashboard: "https://dev.genex.games" } ... L21: function getAnimsBase(override) { L22: const raw = override || process.env[ANIMS_BASE_ENV] || DEFAULT_ANIMS_BASE; L23: return raw.replace(/\/+$/, "") + "/"; ... L40: function getGenexDir() { L41: return path.join(os.homedir(), ".genex"); L42: } ... L55: const here = path.dirname(fileURLToPath(import.meta.url)); L56: const pkg = JSON.parse( L57: fs.readFileSync(path.resolve(here, "..", "package.json"), "utf8")

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L13

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L13

@genex-ai/cli-demo@0.60.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code