@hymbz/comic-read-script@12.10.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@hymbz/comic-read-script@12.10.0: Suspicious npm security report | LPM Firewall

Source & flagged code

5 flagged · loading source

ComicReader.umd.jsView file

15"site/copymanga": "\nlet solid_js_web = require(\"solid-js/web\");\nlet core = require(\"core\");\nlet helper = require(\"helper\");\nlet request = require(\"request\");\nlet solid... L16: "site/ehentai": "\nlet solid_js_web = require(\"solid-js/web\");\nlet components_Manga = require(\"components/Manga\");\nlet core = require(\"core\");\nlet helper = require(\"helpe... L17: "site/jm": "\nlet core = require(\"core\");\nlet helper = require(\"helper\");\n//#region src/site/jm.tsx\ncore.setupSiteAdapter({\n name: \"jm\",\n getPageContext: () => {\n if (...

High

Eval

Package source references dynamic code evaluation.

ComicReader.umd.jsView on unpkg · L15

5"helper/languages": "\n//#region src/helper/languages.ts\nconst langList = [\n \"zh\",\n \"en\",\n \"ru\"\n];\n/** 判断传入的字符串是否是支持的语言类型代码 */\nconst isLanguages = (lang) => Boolean(la... L6: helper: "\nlet solid_js_web = require(\"solid-js/web\");\nlet helper_languages = require(\"helper/languages\");\nlet solid_js = require(\"solid-js\");\nlet solid_js_store = require... L7: request: "\nlet components_Toast = require(\"components/Toast\");\nlet helper = require(\"helper\");\n//#region src/request.ts\nconst xmlHttpRequest = (details) => new Promise((res...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ComicReader.umd.jsView on unpkg · L5

ComicRead-AdGuard.user.jsView file

•Browser cookie sent to a fixed external endpoint in ComicRead-AdGuard.user.js: // @resource solid-js https://cdn.jsdelivr.net/npm/solid-js@1.9.8/dist/solid.cjs // @resource fflate https://cdn.jsdelivr.net/npm/fflate@0.8.2/umd/index.js // @resource jsqr https://cdn.jsdelivr.net/npm/jsqr@1.4.0/dist/jsQR.js // @resource comlink https://cdn.jsdelivr.net/npm/comlink@4.4.2/dist/umd/comlink.min.js // @resource solid-js|store https://cdn.jsdelivr.net/npm/solid-js@1.9.8/store/dist/store.cjs // @resource solid-js|web https://cdn.jsdelivr.net/npm/solid-js@1.9.8/web/dist/web.cjs // @resource _tensorflow|tfjs https://cdn.jsdelivr.net/npm/@tensorflow/tfjs@4.22.0/dist/tf.min.js // @resource _tensorflow|tfjs-backend-webgpu https://cdn.jsdelivr.net/np

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ComicRead-AdGuard.user.jsView on unpkg

ComicRead.user.jsView file

44// @grant GM_getResourceText L45: // @grant GM_xmlhttpRequest L46: // @grant GM.addValueChangeListener ... L55: // @grant unsafeWindow L56: // @icon data:image/png;base64,[redacted]... L57: // @resource solid-js https://registry.npmmirror.com/solid-js/1.9.8/files/dist/solid.cjs ... L5873: const json = await helper.ensureGmValue("@model.json", async () => { L5874: return (await request.request("https://cdn.jsdelivr.net/npm/@hymbz/comic-read-script@11.12.1/public/realcugan/2x-conservative-128/model.json", { noTip: true })).responseText; L5875: }); ... L11613: } L11614: let newUrl = await this.blobUrlResolver.resolve(e); L11615: if (seq !== this.updateSeq || generation !== this.generation) return;

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

ComicRead.user.jsView on unpkg · L44

18192const getPageImg = async (i) => { const res = await unsafeWindow.$.ajax({ type: "GET", url: "chapterfun.ashx", data: { cid: unsafeWindow.DM5_CID, page: i, key: unsafeWindow.$("#dm5_key").length > 0 ? unsafeWindow.$("#dm5_key").val() : "", language: 1, gtk: 6, _cid: unsafeWindow.DM5_CID, _mid: unsafeWindow.DM5_MID, _dt: unsafeWindow.DM5_VIEWSIGN_DT, _sign: unsafeWindow.DM5_VIEWSIGN } }); return eval(res);

Medium

Ai Review Evidence

The userscript evaluates text returned by comic-site HTTP endpoints.

ComicRead.user.jsView on unpkg · L18192

Source & flagged code

5 flagged

ComicReader.umd.jsView file

15"site/copymanga": "\nlet solid_js_web = require(\"solid-js/web\");\nlet core = require(\"core\");\nlet helper = require(\"helper\");\nlet request = require(\"request\");\nlet solid... L16: "site/ehentai": "\nlet solid_js_web = require(\"solid-js/web\");\nlet components_Manga = require(\"components/Manga\");\nlet core = require(\"core\");\nlet helper = require(\"helpe... L17: "site/jm": "\nlet core = require(\"core\");\nlet helper = require(\"helper\");\n//#region src/site/jm.tsx\ncore.setupSiteAdapter({\n name: \"jm\",\n getPageContext: () => {\n if (...

High

Eval

Package source references dynamic code evaluation.

ComicReader.umd.jsView on unpkg · L15

5"helper/languages": "\n//#region src/helper/languages.ts\nconst langList = [\n \"zh\",\n \"en\",\n \"ru\"\n];\n/** 判断传入的字符串是否是支持的语言类型代码 */\nconst isLanguages = (lang) => Boolean(la... L6: helper: "\nlet solid_js_web = require(\"solid-js/web\");\nlet helper_languages = require(\"helper/languages\");\nlet solid_js = require(\"solid-js\");\nlet solid_js_store = require... L7: request: "\nlet components_Toast = require(\"components/Toast\");\nlet helper = require(\"helper\");\n//#region src/request.ts\nconst xmlHttpRequest = (details) => new Promise((res...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

ComicReader.umd.jsView on unpkg · L5

ComicRead-AdGuard.user.jsView file

•Browser cookie sent to a fixed external endpoint in ComicRead-AdGuard.user.js: // @resource solid-js https://cdn.jsdelivr.net/npm/solid-js@1.9.8/dist/solid.cjs // @resource fflate https://cdn.jsdelivr.net/npm/fflate@0.8.2/umd/index.js // @resource jsqr https://cdn.jsdelivr.net/npm/jsqr@1.4.0/dist/jsQR.js // @resource comlink https://cdn.jsdelivr.net/npm/comlink@4.4.2/dist/umd/comlink.min.js // @resource solid-js|store https://cdn.jsdelivr.net/npm/solid-js@1.9.8/store/dist/store.cjs // @resource solid-js|web https://cdn.jsdelivr.net/npm/solid-js@1.9.8/web/dist/web.cjs // @resource _tensorflow|tfjs https://cdn.jsdelivr.net/npm/@tensorflow/tfjs@4.22.0/dist/tf.min.js // @resource _tensorflow|tfjs-backend-webgpu https://cdn.jsdelivr.net/np

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

ComicRead-AdGuard.user.jsView on unpkg

ComicRead.user.jsView file

44// @grant GM_getResourceText L45: // @grant GM_xmlhttpRequest L46: // @grant GM.addValueChangeListener ... L55: // @grant unsafeWindow L56: // @icon data:image/png;base64,[redacted]... L57: // @resource solid-js https://registry.npmmirror.com/solid-js/1.9.8/files/dist/solid.cjs ... L5873: const json = await helper.ensureGmValue("@model.json", async () => { L5874: return (await request.request("https://cdn.jsdelivr.net/npm/@hymbz/comic-read-script@11.12.1/public/realcugan/2x-conservative-128/model.json", { noTip: true })).responseText; L5875: }); ... L11613: } L11614: let newUrl = await this.blobUrlResolver.resolve(e); L11615: if (seq !== this.updateSeq || generation !== this.generation) return;

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

ComicRead.user.jsView on unpkg · L44

18192const getPageImg = async (i) => { const res = await unsafeWindow.$.ajax({ type: "GET", url: "chapterfun.ashx", data: { cid: unsafeWindow.DM5_CID, page: i, key: unsafeWindow.$("#dm5_key").length > 0 ? unsafeWindow.$("#dm5_key").val() : "", language: 1, gtk: 6, _cid: unsafeWindow.DM5_CID, _mid: unsafeWindow.DM5_MID, _dt: unsafeWindow.DM5_VIEWSIGN_DT, _sign: unsafeWindow.DM5_VIEWSIGN } }); return eval(res);

Medium

Ai Review Evidence

The userscript evaluates text returned by comic-site HTTP endpoints.

ComicRead.user.jsView on unpkg · L18192