@infinitestudios/hands-body-and-feet@2.4.0: Suspicious npm | LPM Firewall

Loading npm security reports…

@infinitestudios/hands-body-and-feet@2.4.0: Suspicious npm | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/chunk-5MUWB6QI.jsView file

1755// src/control-panel/open-browser.ts L1756: import { spawn } from "child_process"; L1757: import { readFileSync as readFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-5MUWB6QI.jsView on unpkg · L1755

1771if (process.platform === "win32" || isWsl()) { L1772: command = "cmd.exe"; L1773: args = ["/c", "start", "", url];

High

Shell

Package source references shell execution.

dist/chunk-5MUWB6QI.jsView on unpkg · L1771

128const available = []; L129: const ipfsApiUrl = env["IPFS_API_URL"] ?? "http://localhost:5001"; L130: if (hasKey(env, "IPFS_API_URL") || ipfsApiUrl === "http://localhost:5001") { ... L174: } L175: function getCapabilityStatuses(env = process.env) { L176: return { ... L200: const pathVal = env[envPathKey] ?? ""; L201: const separator = process.platform === "win32" ? ";" : ":"; L202: const dirs = pathVal.split(separator); ... L716: try { L717: return JSON.parse(value); L718: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-5MUWB6QI.jsView on unpkg · L128

•matchType = previous_version_dangerous_delta matchedPackage = @infinitestudios/hands-body-and-feet@2.3.2 matchedIdentity = npm:[redacted]:2.3.2 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-5MUWB6QI.jsView on unpkg

dist/chunk-N5FCQGJU.jsView file

3269steps, L3270: message: "No Hermes install found. Install Hermes first (https://github.com/NousResearch/hermes-agent), then re-run hermes_setup." L3271: }; ... L3281: try { L3282: const r = spawnSync(install.python, ["-c", PATCH_PY, install.agentDir], { L3283: encoding: "utf8", L3284: env: { ...process.env, PYTHONPATH: install.agentDir } L3285: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-N5FCQGJU.jsView on unpkg · L3269

1486async function ngrokCreate(port, label) { L1487: const ngrok = await import("@ngrok/ngrok"); L1488: const listener = await ngrok.forward({ addr: port });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-N5FCQGJU.jsView on unpkg · L1486

70const signingInput = `${headerB64}.${payloadB64}`; L71: const expectedSig = createHmac("sha256", secret).update(signingInput).digest("base64url"); L72: if (expectedSig !== signatureB64) { ... L78: async function validatePassport(token, registryUrl) { L79: const jwtSecret = process.env["OPENTRUST_JWT_SECRET"]; L80: if (jwtSecret) { ... L84: try { L85: response = await fetch(`${registryUrl}/api/v1/passports/validate`, { L86: method: "POST", ... L294: { domain: "wallet", name: "send_usdc", minTrustLevel: 2, description: "Transfer USDC on Base or Polygon (subject to spend caps).", spendPolicy: { maxPerCallUsdc: 100, dailyCapUsdc:... L295: { domain: "wallet", name: "sign_message", minTrustLevel: 2, description: "Sign a plain text message with the wallet private key." }, L296: { domain: "wa

Source & flagged code

7 flagged

dist/chunk-5MUWB6QI.jsView file

Lines 108-148javascript

108 return {

109 ready,

110 provider: ready ? "docker" : void 0,

111 availableProviders: ready ? ["docker"] : [],

112 note: ready ? hasDockerHost ? "Docker via DOCKER_HOST" : "Docker via /var/run/docker.sock" : "Docker socket not found - install Docker or set DOCKER_HOST"

113 };

114}

115function detectTunnel(env) {

116 const available = ["cloudflared"];

117 if (hasKey(env, "NGROK_AUTHTOKEN")) {

118 available.push("ngrok");

119 }

120 return {

121 ready: true,

122 provider: available.includes("ngrok") ? "ngrok" : "cloudflared",

123 availableProviders: available,

124 note: available.includes("ngrok") ? "Tunnels via ngrok (authenticated) and cloudflared" : "Tunnels via cloudflared (unauthenticated) - set NGROK_AUTHTOKEN for ngrok"

125 };

126}

127function detectIpfs(env) {

128 const available = [];

129 const ipfsApiUrl = env["IPFS_API_URL"] ?? "http://localhost:5001";

130 if (hasKey(env, "IPFS_API_URL") || ipfsApiUrl === "http://localhost:5001") {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-5MUWB6QI.jsView on unpkg · L128

131 available.push("local-kubo");

132 }

133 if (hasKey(env, "WEB3_STORAGE_TOKEN") || hasKey(env, "W3_PRINCIPAL")) {

134 available.push("web3.storage");

135 }

136 return {

137 ready: available.length > 0,

138 provider: available[0],

139 availableProviders: available,

140 note: available.includes("web3.storage") ? "IPFS via web3.storage (pinning service) and local Kubo" : "IPFS via local Kubo node - set WEB3_STORAGE_TOKEN for pinning"

141 };

142}

143function detectPhysicalMail(env) {

144 const available = [];

145 if (hasKey(env, "POSTSCAN_API_KEY") && hasKey(env, "POSTSCAN_ACCOUNT_ID")) {

146 available.push("postscan");

147 }

148 if (hasKey(env, "EARTH_CLASS_MAIL_API_KEY") || hasKey(env, "ECM_API_KEY")) {

Lines 1735-1791javascript

1735 seedControlPanelDemoIfEmpty();

1736 } catch {

1737 }

1738 return await new Promise((resolve) => {

1739 const server =

•matchType = previous_version_dangerous_delta matchedPackage = @infinitestudios/hands-body-and-feet@2.3.2 matchedIdentity = npm:[redacted]:2.3.2 similarity = 0.786 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-5MUWB6QI.jsView on unpkg

dist/chunk-N5FCQGJU.jsView file

Lines 50-90javascript

50 super(message);

51 this.statusCode = statusCode;

52 this.name = "AuthError";

53 }

54 statusCode;

55};

56function