@gentbajko/slopify@1.0.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@gentbajko/slopify@1.0.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/updater/worker.jsView file

1Source sends the broad process environment to a literal external destination. L1: import { spawn } from "node:child_process"; L2: import { closeSync, openSync } from "node:fs"; ... L20: await mkdir(directory, { recursive: true, mode: 0o700 }); L21: await writeFile(join(directory, ".npmrc"), "registry=https://registry.npmjs.org/\n@gentbajko:registry=https://registry.npmjs.org/\n", { mode: 0o600 }); L22: await writeFile(join(directory, ".global-npmrc"), "", { mode: 0o600 }); ... L39: env: { L40: ...process.env, L41: SLOPIFY_SKIP_MANAGED_UPDATE: "1", ... L57: healthy: async (version) => { L58: await waitForServer(plan, version, () => child?.exitCode !== null || child?.signalCode !== null); L59: child?.unref();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/updater/worker.jsView on unpkg · L1

dist/slices/video/ffmpeg.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/slices/video/ffmpeg.js#virtual:normalized:round1View on unpkg

dist/slices/telemetry/collector-client.jsView file

22const response = await fetch(`${endpoint}/events`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ events }),

High

Ai Review Evidence

The app posts telemetry to a hardcoded external collector.

dist/slices/telemetry/collector-client.jsView on unpkg · L22

dist/slices/telemetry/flush.jsView file

100function envelope(event, machineId) { return { id: event.id, machineId, type: event.type, payload: event.payload, createdAt: event.createdAt, };

High

Ai Review Evidence

Each upload includes a persistent machine identifier and usage events.

dist/slices/telemetry/flush.jsView on unpkg · L100

Source & flagged code

4 flagged

dist/updater/worker.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { closeSync, openSync } from "node:fs";

3import { appendFile, copyFile, mkdir, rm, writeFile } from "node:fs/promises";

4import { join } from "node:path";

5import { setTimeout as delay } from "node:timers/promises";

6import { runUpdateFlow } from "./install-flow.js";

7import { activateUpdate, installArgs, installDirectory, installedEntry, pruneUpdateArtifacts, restartArgs, } from "./plan.js";

8import { candidateReady } from "./readiness.js";

9export async function performUpdate(plan, handoff) {

10 const directory = installDirectory(plan.dataDir, plan.version);

11 const logs = join(plan.dataDir, "logs");

12 await mkdir(logs, { recursive: true, mode: 0o700 });

13 const logFile = join(logs, "updates.log");

14 const database = join(plan.dataDir, "slopify.db");

15 const backup = join(plan.dataDir, "updates", `before-${plan.version}-${Date.now()}.db`);

16 let child;

17 const log = async (message) => appendFile(logFile, `${new Date().toISOString()} ${message}\n`, { mode: 0o600 });

18 await runUpdateFlow(plan, {

19 install: async () => {

20 await mkdir(directory, { recursive: true, mode: 0o700 });

21 await writeFile(join(directory, ".npmrc"), "registry=https://registry.npmjs.org/\n@gentbajko:registry=https://registry.npmjs.org/\n", { mode: 0o600 });

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/updater/worker.jsView on unpkg · L1

dist/slices/video/ffmpeg.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/slices/video/ffmpeg.js#virtual:normalized:round1View on unpkg

dist/slices/telemetry/collector-client.jsView file

Lines 2-42javascript

2// configurable. The environment variable below is a test seam, not a documented knob:

3// packages/app/test/telemetry-flush.test.ts points it at a fake collector.

4export const defaultCollectorUrl = "https://collector.slopify.stream";

5export function collectorEndpoint(env) {

6

dist/slices/telemetry/flush.jsView file

Lines 80-112javascript

80 .finally(() => {

81 running = false;

82 if (again) {

83 again = false;

84 soon();