@infinitestudios/hands-body-and-feet@2.5.0: Suspicious npm | LPM Firewall

Loading npm security reports…

@infinitestudios/hands-body-and-feet@2.5.0: Suspicious npm | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/chunk-URXIH4RR.jsView file

885// src/capabilities/tunnel/index.ts L886: import { spawn } from "child_process"; L887: import { randomUUID as randomUUID2 } from "crypto";

High

Child Process

Package source references child process execution.

dist/chunk-URXIH4RR.jsView on unpkg · L885

2674try { L2675: const winUser = execSync("cmd.exe /c echo %USERNAME%", { L2676: encoding: "utf8",

High

Shell

Package source references shell execution.

dist/chunk-URXIH4RR.jsView on unpkg · L2674

2719steps, L2720: message: "No Hermes install found. Install Hermes first (https://github.com/NousResearch/hermes-agent), then re-run hermes_setup." L2721: }; ... L2731: try { L2732: const r = spawnSync(install.python, ["-c", PATCH_PY, install.agentDir], { L2733: encoding: "utf8", L2734: env: { ...process.env, PYTHONPATH: install.agentDir } L2735: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-URXIH4RR.jsView on unpkg · L2719

•matchType = previous_version_dangerous_delta matchedPackage = @infinitestudios/hands-body-and-feet@2.4.0 matchedIdentity = npm:[redacted]:2.4.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-URXIH4RR.jsView on unpkg

936async function ngrokCreate(port, label) { L937: const ngrok = await import("@ngrok/ngrok"); L938: const listener = await ngrok.forward({ addr: port });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-URXIH4RR.jsView on unpkg · L936

99const row = db.prepare("SELECT value_json FROM memory WHERE key = ?").get(key); L100: return row ? JSON.parse(row.value_json) : null; L101: } ... L156: const started = Date.now(); L157: const response = await fetch(cfg.modalImageEndpoint, { L158: method: "POST", ... L163: }, L164: body: JSON.stringify({ prompt: params.prompt, width, height }) L165: }); ... L316: import { ethers } from "ethers"; L317: var BASE_RPC = process.env.BASE_RPC_URL ?? "https://mainnet.base.org"; L318: var USDC_BASE = "[redacted]";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-URXIH4RR.jsView on unpkg · L99

Source & flagged code

6 flagged

dist/chunk-URXIH4RR.jsView file

Lines 79-119javascript

79async function setIdentityBinding(params, claims) {

80 enforceTrust(claims, SET_IDENTITY_TOOL);

81 const db = openDb();

82 const existing = db.prepare("SELECT * FROM agent_identity WHERE agent_id = ?").get(claims.agentId);

83 const now = (/* @__PURE__ */ new Date()).toISOString();

84 if (existing) {

85 db.prepare(`UPDATE agent_identity SET ${params.field} = ?, updated_at = ? WHERE agent_id = ?`).run(params.value, now, claims.agentId);

86 } else {

87 const init = { primary_wallet: null, email: null, phone: null };

88 init[params.field] = params.value;

89 db.prepare("INSERT INTO agent_identity (agent_id, primary_wallet, email, phone, updated_at) VALUES (?, ?, ?, ?, ?)").run(claims.agentId, init.primary_wallet, init.email, init.phone, now);

90 }

91 return { updated: true };

92}

93async function getMemory(params, claims) {

94 enforceTrust(claims, GET_MEMORY_TOOL);

95 return { key: params.key, value: readMemoryValue(params.key) };

96}

97function readMemoryValue(key) {

98 const db = openDb();

99 const row = db.prepare("SELECT value_json FROM memory WHERE key = ?").get(key);

100 return row ? JSON.parse(row.value_json) : null;

101}

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-URXIH4RR.jsView on unpkg · L99

102async function setMemory(params, claims) {

103 enforceTrust(claims, SET_MEMORY_TOOL);

104 const db = openDb();

105 const now = (/* @__PURE__ */ new Date()).toISOString();

106 db.prepare(`

107 INSERT INTO memory (key, value_json, updated_at) VALUES (?, ?, ?)

108 ON CONFLICT(key) DO UPDATE SET value_json = excluded.value_json, updated_at = excluded.updated_at

109 `).run(params.key, JSON.stringify(params.value), now);

110 return { key: params.key, saved: true };

111}

112async function listMemory(_params, claims) {

113 enforceTrust(claims, LIST_MEMORY_TOOL);

114 const db = openDb();

115 const rows = db.prepare("SELECT key FROM memory ORDER BY updated_at DESC").all();

116 return { keys: rows.map((r) => r.key) };

117}

118async function deleteMemory(params, claims) {

119 enforceTrust(claims, DELETE_MEMORY_TOOL);

Lines 865-905javascript

865 msg.dateSent,

866 (/* @__PURE__ */ new Date()).toISOString()

867 );

868 }

869 return { messages };

870}

871async function releasePhoneNumber(params

Lines 916-956javascript

916 }

917 };

918 proc.stdout.on("data", onData);

919 proc.stderr.on("data", onData);

920 proc.on("error", (err2) => {

921 if (!

Lines 2654-2739javascript

2654 else:

2655 results["run_adapter"] = "WARN: YuanbaoAdapter return anchor not found"

2656else:

2657 results["run_adapter"] = "already present"

2658

2659if changed2:

2660 run_py.

•matchType = previous_version_dangerous_delta matchedPackage = @infinitestudios/hands-body-and-feet@2.4.0 matchedIdentity = npm:[redacted]:2.4.0 similarity = 0.571 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-URXIH4RR.jsView on unpkg