@gentbajko/slopify@3.4.2: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

@gentbajko/slopify@3.4.2: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/adapters/ffmpeg.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/adapters/ffmpeg.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapters/ffmpeg.jsView on unpkg

23} L24: const require = createRequire(import.meta.url); L25: const version = deps.version ??

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/ffmpeg.jsView on unpkg · L23

dist/web/assets/index-B4HZ24q0.jsView file

247contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-B4HZ24q0.jsView on unpkg · L247

dist/extension/slopify-studio-firefox.zipView file

•path = dist/extension/slopify-studio-firefox.zip kind = high_entropy_blob sizeBytes = 51276 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = compressed_blob sizeBytes = 51276 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = nested_archive_needs_inspection sizeBytes = 51276 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/extension/slopify-studio-firefox.zipView on unpkg

dist/adapters/alignment/text.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/alignment/text.js#virtual:normalized:round1View on unpkg

dist/edge/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/edge/open-browser.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/edge/open-browser.jsView on unpkg

dist/updater/forward.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/updater/forward.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/updater/forward.jsView on unpkg

Source & flagged code

9 flagged

dist/adapters/ffmpeg.jsView file

Lines 3-43javascript

3import { createRequire } from "node:module";

4import { join } from "node:path";

5import { promisify } from "node:util";

6import { z } from "zod";

7import { redact } from "../kernel/log.js";

8// ffmpeg-static exports a path even when npm skipped its install script. Recover using

9// that dependency's own downloader, including its source notice and license, without

10// writing into an npx cache or requiring dependency lifecycle scripts to be enabled.

11export async function prepareFfmpeg(deps) {

12 const override = deps.env.SLOPIFY_FFMPEG?.trim() || deps.env.FFMPEG_BIN?.trim();

13 if (override) {

14 await verify(override);

15 return override;

16 }

17 if (typeof deps.bundled !== "string" || deps.bundled === "") {

18 throw new Error(`Slopify has no built-in copy of ffmpeg (the tool it uses to make video) for this kind of computer. Install ffmpeg, then restart Slopify. ${remedy}`);

19 }

20 if (existsSync(deps.bundled)) {

21 await verify(deps.bundled);

22 return deps.bundled;

23 }

24 const require = createRequire(import.meta.url);

25 const version = deps.version ??

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/adapters/ffmpeg.jsView on unpkg · L23

26 z.object({ version: z.string() }).parse(require("ffmpeg-static/package.json")).version;

27 const installer = deps.installer ?? require.resolve("ffmpeg-static/install.js");

28 const root = join(deps.dataDir, "bin");

29 const cached = join(root, `ffmpeg-static-${version}-${process.platform}-${process.arch}`);

30 const name = process.platform === "win32" ? "ffmpeg.exe" : "ffmpeg";

31 const bin = join(cached, name);

32 if (existsSync(bin)) {

33 await verify(bin);

34 return bin;

35 }

36 deps.report?.("Slopify's ffmpeg download is missing. Downloading it before starting…");

37 mkdirSync(root, { recursive: true, mode: 0o700 });

38 const staging = mkdtempSync(join(root, ".ffmpeg-"));

39 try {

40 const target = join(staging, name);

41 await promisify(execFile)(process.execPath, [installer], {

42 env: { ...deps.env, FFMPEG_BIN: target },

43 windowsHide: true,

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/adapters/ffmpeg.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/adapters/ffmpeg.jsView on unpkg

dist/web/assets/index-B4HZ24q0.jsView file

247contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/web/assets/index-B4HZ24q0.jsView on unpkg · L247

dist/extension/slopify-studio-firefox.zipView file

•path = dist/extension/slopify-studio-firefox.zip kind = high_entropy_blob sizeBytes = 51276 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = compressed_blob sizeBytes = 51276 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/extension/slopify-studio-firefox.zipView on unpkg

•path = dist/extension/slopify-studio-firefox.zip kind = nested_archive_needs_inspection sizeBytes = 51276 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/extension/slopify-studio-firefox.zipView on unpkg

dist/adapters/alignment/text.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/adapters/alignment/text.js#virtual:normalized:round1View on unpkg

dist/edge/open-browser.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/edge/open-browser.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/edge/open-browser.jsView on unpkg

dist/updater/forward.jsView file

•matchType = normalized_sha256 matchedPackage = @gentbajko/slopify@1.0.1 matchedPath = dist/updater/forward.js matchedIdentity = npm:QGdlbnRiYWprby9zbG9waWZ5:1.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/updater/forward.jsView on unpkg