@happyskillsai/instant-canvas@0.18.0: Suspicious npm security | LPM Firewall

Loading npm security reports…

@happyskillsai/instant-canvas@0.18.0: Suspicious npm security | LPM Firewall

Source & flagged code

6 flagged · loading source

scripts/instantcanvas.jsView file

16const http = require('node:http') L17: const { spawn } = require('node:child_process') L18:

High

Child Process

Package source references child process execution.

scripts/instantcanvas.jsView on unpkg · L16

3L4: // InstantCanvas CLI. stdout carries EXACTLY ONE JSON document per run; L5: // every log/progress line goes to stderr (through lib/redact). ... L9: if (major < 20) { L10: process.stderr.write(`InstantCanvas requires Node >= 20 (found ${process.versions.node}).\n`) L11: process.exit(2) ... L15: const path = require('node:path') L16: const http = require('node:http') L17: const { spawn } = require('node:child_process') L18:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/instantcanvas.jsView on unpkg · L3

scripts/web/vendor/highlight.min.jsView file

3164;hljs.registerLanguage("pony",e)})(); L3165: /*! `powershell` grammar compiled for Highlight.js 11.11.1 */ L3166: (()=>{var e=(()=>{"use strict";return e=>{const n={$pattern:/-?[A-z\.\-]+\b/,

High

Shell

Package source references shell execution.

scripts/web/vendor/highlight.min.jsView on unpkg · L3164

scripts/kernel.jsView file

6L7: const http = require('node:http') L8: const fs = require('node:fs') ... L11: const os = require('node:os') L12: const { execFile } = require('node:child_process') L13: const { promisify } = require('node:util') ... L34: L35: const WEB_DIR = path.join(__dirname, 'web') L36: const VERSION = PKG_VERSION ... L55: if (!rootArg || !fs.existsSync(rootArg) || !fs.statSync(rootArg).isDirectory()) { L56: process.stderr.write('kernel: workspace root missing or not a directory: ' + String(rootArg) + '\n') L57: process.exit(2)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/kernel.jsView on unpkg · L6

scripts/web/vendor/inter-latin-600-normal.woff2View file

•path = scripts/web/vendor/inter-latin-600-normal.woff2 kind = high_entropy_blob sizeBytes = 24304 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

scripts/web/vendor/inter-latin-600-normal.woff2View on unpkg

scripts/web/vendor/plotly.min.jsView file

•path = scripts/web/vendor/plotly.min.js kind = oversized_source_file sizeBytes = 2765319 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scripts/web/vendor/plotly.min.jsView on unpkg

Source & flagged code

6 flagged

scripts/instantcanvas.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2'use strict'

3

4// InstantCanvas CLI. stdout carries EXACTLY ONE JSON document per run;

5// every log/progress line goes to stderr (through lib/redact).

6// Exit codes: 0 clean outcome, 1 spec error, 2 internal error.

7

8const major = Number(process.versions.node.split('.')[0])

9if (major < 20) {

10 process.stderr.write(`InstantCanvas requires Node >= 20 (found ${process.versions.node}).\n`)

11 process.exit(2)

12}

13

14const fs = require('node:fs')

15const path = require('node:path')

16const http = require('node:http')

17const { spawn } = require('node:child_process')

18

High

Child Process

Package source references child process execution.

scripts/instantcanvas.jsView on unpkg · L16

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

scripts/instantcanvas.jsView on unpkg · L3

19const registry = require('./lib/registry')

20const { log, redact, errorOut } = require('./lib/redact')

21const { validate, renderHuman } = require('./lib/validate')

22const { catalog } = require('./lib/catalog')

23const { openUrl } = require('./lib/browser')

24const { writeAtomic } = require('./lib/fsatomic')

25const { insideRoot, stateDir, workspaceKey } = require('./lib/paths')

26const { withChrome, findChrome } = require('./lib/cdp')

27const { figureMap } = require('./lib/figures')

28const { PKG_VERSION, UNKNOWN_VERSION } = require('./lib/pkgmeta')

29const { hasMarkdownExtension } = require('./lib/markdownsrc')

30const themeLib = require('./lib/theme')

31const themestore = require('./lib/themestore')

32const skillsconfig = require('./lib/skillsconfig')

33const { companionFor } = require('./lib/companion')

34

35const VERSION = PKG_VERSION

36const KERNEL = path.join(__dirname, 'kernel.js')

scripts/web/vendor/highlight.min.jsView file

3164;hljs.registerLanguage("pony",e)})(); L3165: /*! `powershell` grammar compiled for Highlight.js 11.11.1 */ L3166: (()=>{var e=(()=>{"use strict";return e=>{const n={$pattern:/-?[A-z\.\-]+\b/,

High

Shell

Package source references shell execution.

scripts/web/vendor/highlight.min.jsView on unpkg · L3164

scripts/kernel.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2'use strict'

3

4// InstantCanvas kernel: one persistent process per workspace root.

5// Spawned as: node kernel.js <workspaceRoot>

6

7const http = require('node:http')

8const fs

scripts/web/vendor/inter-latin-600-normal.woff2View file

•path = scripts/web/vendor/inter-latin-600-normal.woff2 kind = high_entropy_blob sizeBytes = 24304 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

scripts/web/vendor/inter-latin-600-normal.woff2View on unpkg

scripts/web/vendor/plotly.min.jsView file

•path = scripts/web/vendor/plotly.min.js kind = oversized_source_file sizeBytes = 2765319 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

scripts/web/vendor/plotly.min.jsView on unpkg