@granular-software/sdk@0.4.49: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@granular-software/sdk@0.4.49: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/cli/index.jsView file

6var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> dist/cli/index.js L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L6

7var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto');

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7

6var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L6

6Cross-file remote execution chain: dist/cli/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L6

dist/agent-evals.jsView file

16902try { L16903: new Function(`return (async () => { L16904: ${withoutImports}

High

Eval

Package source references dynamic code evaluation.

dist/agent-evals.jsView on unpkg · L16902

2L3: var promises = require('fs/promises'); L4: var path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agent-evals.jsView on unpkg · L2

Source & flagged code

7 flagged

dist/cli/index.jsView file

6var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/cli/index.jsView on unpkg · L6

6Trigger-reachable chain: manifest.bin -> dist/cli/index.js L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli/index.jsView on unpkg · L6

7var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto');

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L7

6var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L6

6Cross-file remote execution chain: dist/cli/index.js spawns dist/index.js; helper contains network access plus dynamic code execution. L6: var readline = require('readline'); L7: var http = require('http'); L8: var child_process = require('child_process'); L9: var crypto$1 = require('crypto'); ... L85: * Constructs the CommanderError class L86: * @param {number} exitCode suggested exit code which could be used with process.exit L87: * @param {string} code an id string representing the error ... L1245: this._outputConfiguration = { L1246: writeOut: (str) => process10.stdout.write(str), L1247: writeErr: (str) => process10.stderr.write(str), ... L1284: * @returns {Command[]} L1285: * @private

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L6

dist/agent-evals.jsView file

16902try { L16903: new Function(`return (async () => { L16904: ${withoutImports}

High

Eval

Package source references dynamic code evaluation.

dist/agent-evals.jsView on unpkg · L16902

2L3: var promises = require('fs/promises'); L4: var path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agent-evals.jsView on unpkg · L2