@hamak/smart-data-dico@1.18.1: Suspicious npm security report

Loading npm security reports…

@hamak/smart-data-dico@1.18.1: Suspicious npm security report | LPM Firewall

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3import { fileURLToPath } from 'url';

4import { dirname, join, resolve } from 'node:path';

5import { existsSync, mkdirSync, cpSync, writeFileSync, readFileSync } from 'fs';

6import { homedir } from 'node:os';

7import { spawn, spawnSync } from 'child_process';

8import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L6

10const __filename = fileURLToPath(import.meta.url);

11const __dirname = dirname(__filename);

12const PKG_ROOT = join(__dirname, '..');

14// The default SQLite dialect uses Node's built-in node:sqlite, which is gated

15// behind --experimental-sqlite until it stabilises (~Node 23.4). Probe whether

16// this Node needs the flag (load it unflagged → stable; throws → gated) and, if

17// so, add it to the server child's NODE_OPTIONS. Self-correcting across versions:

18// no hardcoded minor boundaries, and never passes an unknown flag to old Node.

19function serverNodeOptions() {

20 const base = process.env.NODE_OPTIONS || '';

21 if (base.includes('--experimental-sqlite')) return base;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/cli.jsView on unpkg · L6

22 const [major, minor] = process.versions.node.split('.').map(Number);

23 const flagSupported = major > 22 || (major === 22 && minor >= 5);

24 if (!flagSupported) return base; // too old: node:sqlite unavailable, flag unknown

25 try {

26 createRequire(import.meta.url)('node:sqlite'); // loads unflagged → already stable

frontend/dist/assets/index-0656249f.jsView file

•path = frontend/dist/assets/index-0656249f.js kind = oversized_source_file sizeBytes = 3547839 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

frontend/dist/assets/index-0656249f.jsView on unpkg

Source & flagged code

3 flagged · loading source

bin/cli.jsView file

6import { homedir } from 'node:os'; L7: import { spawn, spawnSync } from 'child_process'; L8: import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L6

6Cross-file remote execution chain: bin/cli.js spawns backend/dist/validate.mjs; helper contains network access plus dynamic code execution. L6: import { homedir } from 'node:os'; L7: import { spawn, spawnSync } from 'child_process'; L8: import { createRequire } from 'node:module'; ... L10: const __filename = fileURLToPath(import.meta.url); L11: const __dirname = dirname(__filename); L12: const PKG_ROOT = join(__dirname, '..'); ... L19: function serverNodeOptions() { L20: const base = process.env.NODE_OPTIONS || ''; L21: if (base.includes('--experimental-sqlite')) return base; ... L33: try { L34: packageVersion = JSON.parse(readFileSync(join(PKG_ROOT, 'package.json'), 'utf-8')).version || ''; L35: } catch {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/cli.jsView on unpkg · L6

frontend/dist/assets/index-0656249f.jsView file

•path = frontend/dist/assets/index-0656249f.js kind = oversized_source_file sizeBytes = 3547839 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

frontend/dist/assets/index-0656249f.jsView on unpkg

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3import { fileURLToPath } from 'url';

4import { dirname, join, resolve } from 'node:path';

5import { existsSync, mkdirSync, cpSync, writeFileSync, readFileSync } from 'fs';

6import { homedir } from 'node:os';

7import { spawn, spawnSync } from 'child_process';

8import { createRequire } from 'node:module';

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L6

10const __filename = fileURLToPath(import.meta.url);

11const __dirname = dirname(__filename);

12const PKG_ROOT = join(__dirname, '..');

14// The default SQLite dialect uses Node's built-in node:sqlite, which is gated

15// behind --experimental-sqlite until it stabilises (~Node 23.4). Probe whether

16// this Node needs the flag (load it unflagged → stable; throws → gated) and, if

17// so, add it to the server child's NODE_OPTIONS. Self-correcting across versions:

18// no hardcoded minor boundaries, and never passes an unknown flag to old Node.

19function serverNodeOptions() {

20 const base = process.env.NODE_OPTIONS || '';

21 if (base.includes('--experimental-sqlite')) return base;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/cli.jsView on unpkg · L6

22 const [major, minor] = process.versions.node.split('.').map(Number);

23 const flagSupported = major > 22 || (major === 22 && minor >= 5);

24 if (!flagSupported) return base; // too old: node:sqlite unavailable, flag unknown

25 try {

26 createRequire(import.meta.url)('node:sqlite'); // loads unflagged → already stable

frontend/dist/assets/index-0656249f.jsView file

•path = frontend/dist/assets/index-0656249f.js kind = oversized_source_file sizeBytes = 3547839 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

frontend/dist/assets/index-0656249f.jsView on unpkg

@hamak/smart-data-dico@1.18.1

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code