@inkeep/open-knowledge@0.53.0: Manual Review npm security report

Loading npm security reports…

@inkeep/open-knowledge@0.53.0: Manual Review npm security report | LPM Firewall

Source & flagged code

19 flagged

dist/lib-DuDqLKFD.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-DuDqLKFD.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-DuDqLKFD.mjs

dist/lib-DuDqLKFD.mjsView on unpkg · L39

1import{o as e,t}from"./chunk-DTipWd-i.mjs";import{n}from"./wrapper-BcpqREsI.mjs";import{Blob as r,Buffer as i}from"buffer";import{TextDecoder as a,TextEncoder as o}from"util";impor... L2: `+t+`at`)}else typeof r==`object`&&r.message&&r.stack?n+=r.stack.replace(/\n at/gm,` ... L38: Y3FblSokcA== L39: -----END CERTIFICATE-----`,key:`-----BEGIN PRIVATE KEY----- L40: [redacted] ... L67: \r L68: `);var qu=class e{reject=null;resolve=null;listeners={onSignalAbort:this.onSignalAbort.bind(this)};isChunkedTransfer=!1;isProperLastChunkReceived=!1;previousChunk=null;nodeRequest=... L69: ... L71: `),o+=a,i&&!i.disableErrorCapturing&&i.errorCapture===Ls.tryAndCatch&&(o+=`} catch(e) { $happy_dom.dispatchError(e); }`),o+=`})`;let s=null;try{s=r[Fe](o,{filename:r.location.href}... L72: `);let o=a;s

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-DuDqLKFD.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib-DuDqLKFD.mjsView on unpkg · L1

dist/git-handle-CH1DpBYP.mjsView file

Lines 1-10javascript

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{Do as r}from"./src-RGB2pEts.mjs";import{delimiter as i,normalize as a,resolve as o}from"node:path"

dist/src-BVxZYLJj.mjsView file

20`:``)+r)}function yw(e){return e.bridgeLossReporter?{reporter:e.bridgeLossReporter,writerId:e.agentId}:void 0}function bw(e,t,n){let r=nw(e);r&&Cw(e.getText(`source`).toString(),t,... L21: `)){let e=n.trim();if(e===``)continue;let r=/^([a-fA-F0-9]{64})\s+\*?(.+)$/.exec(e);if(r===null)continue;let[,i,a]=r;if(a.trim().split(/[\\/]/).pop()===t)return i.toLowerCase()}ret... L22: `)}\n`;this.enqueue(e,async()=>{if(!this.appendBroken.has(e))try{await _s(this.eventsPath(e),n)}catch(t){this.appendBroken.add(e),this.log.error({err:t,threadId:e},`[acp-persist] e...

High

Shell

Package source references shell execution.

dist/src-BVxZYLJj.mjsView on unpkg · L20

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{$t as r,At as i,Bt as a,C as o,Ct as s,Et as c,F as l,Ft as u,Gt as d,I as f,It as p,Jt as m,Kt as h,L as g,Lt as _,Mt... L2: `)){let e=n.trim();if(e.startsWith(`ok-contributors: `))try{let n=JSON.parse(e.slice(17));if(typeof n==`object`&&n&&`id`in n&&typeof n.id==`string`&&`name`in n&&typeof n.name==`str... L3: `)){let e=t.trim();if(!e.startsWith(Zu))continue;let n;try{n=JSON.parse(e.slice(10))}catch{return null}return typeof n!=`object`||!n?null:$u(n)}return null}function ed(e){if(!e)ret... L4: `)){let e=n.trim();if(!e.startsWith(Zu))continue;let r;try{r=JSON.parse(e.slice(10))}catch{continue}if(typeof r!=`object`||!r)continue;let i=$u(r);i&&t.push(i)}return t}function bn... L5: `,i=e.getWriter();try{await i.write(n.encode

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-BVxZYLJj.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-D8tv8KWc.mjsView file

Lines 1-5javascript

1import{t as e}from"./chunk-DXB73IDG-q-dGnwlc.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function constructor allows arbitrary code execution`},{prop:`eval`,target:globalThis,violationType:`eval`

dist/public/assets/src-gXOrH5MP.jsView file

2contains invisible/control Unicode U+2060 (word joiner) `);e!==r&&t.delete(e+n,r-e),s.length>0&&t.insert(e+n,s),n+=s.length-(r-e)})},this.conf)}destroy(){this._ytext.unobserve(this._observer)}},T=f.fromClass(w),E=v.baseTheme({".cm-ySelection":{},".cm-yLineSelection":{padding:0,margin:`0px 2px 0p

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/src-gXOrH5MP.jsView on unpkg · L2

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 788152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-CFfKBclM.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-CFfKBclM.mjsView on unpkg

dist/native/index.jsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.31.0 matchedPath = dist/native/index.js matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.31.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/js-exec-VXN6TZ7U-BrugyKqi.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.24.0 matchedPath = dist/js-exec-M6UR76J5-Cu6NIWHE.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.24.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/js-exec-VXN6TZ7U-BrugyKqi.mjsView on unpkg

dist/open-browser-CtVpc_8x.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.30.0 matchedPath = dist/open-browser-B0EHWyOL.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.30.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/open-browser-CtVpc_8x.mjsView on unpkg

dist/chunk-HOUHSVGY-C3h3PdhC.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-HOUHSVGY-msG2U0fQ.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-HOUHSVGY-C3h3PdhC.mjsView on unpkg

dist/chunk-PUDLZKDR-CIWYIjrF.mjsView file

•matchType = normalized_sha256 matchedPackage = @inkeep/open-knowledge@0.36.0 matchedPath = dist/chunk-PUDLZKDR-7CuClQq1.mjs matchedIdentity = npm:QGlua2VlcC9vcGVuLWtub3dsZWRnZQ:0.36.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-PUDLZKDR-CIWYIjrF.mjsView on unpkg

Source & flagged code

19 flagged · loading source

dist/lib-DuDqLKFD.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-DuDqLKFD.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-DuDqLKFD.mjs

dist/lib-DuDqLKFD.mjsView on unpkg · L39

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-DuDqLKFD.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib-DuDqLKFD.mjsView on unpkg · L1

dist/git-handle-CH1DpBYP.mjsView file

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{Do as r}from"./src-RGB2pEts.mjs";import{delimiter as i,normalize as a,resolve as o}from"node:path";import{existsSync a... L2: `).join(`

High

Child Process

Package source references child process execution.

dist/git-handle-CH1DpBYP.mjsView on unpkg · L1

dist/src-BVxZYLJj.mjsView file

High

Shell

Package source references shell execution.

dist/src-BVxZYLJj.mjsView on unpkg · L20

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-BVxZYLJj.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-D8tv8KWc.mjsView file

1import{t as e}from"./chunk-DXB73IDG-q-dGnwlc.mjs";function t(){let e=[{prop:`Function`,target:globalThis,violationType:`function_constructor`,strategy:`throw`,reason:`Function cons... L2:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-5QMZ5MUS-D8tv8KWc.mjsView on unpkg · L1

dist/public/assets/src-gXOrH5MP.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/src-gXOrH5MP.jsView on unpkg · L2

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 788152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-CFfKBclM.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-CFfKBclM.mjsView on unpkg

dist/native/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/js-exec-VXN6TZ7U-BrugyKqi.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/js-exec-VXN6TZ7U-BrugyKqi.mjsView on unpkg

dist/open-browser-CtVpc_8x.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/open-browser-CtVpc_8x.mjsView on unpkg

dist/chunk-HOUHSVGY-C3h3PdhC.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-HOUHSVGY-C3h3PdhC.mjsView on unpkg

dist/chunk-PUDLZKDR-CIWYIjrF.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-PUDLZKDR-CIWYIjrF.mjsView on unpkg

Source & flagged code

19 flagged

dist/lib-DuDqLKFD.mjsView file

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/lib-DuDqLKFD.mjsView on unpkg · L39

39patternName = private_key_rsa severity = critical line = 39 matchedText = -----END...----

Critical

Secret Pattern

RSA private key in dist/lib-DuDqLKFD.mjs

dist/lib-DuDqLKFD.mjsView on unpkg · L39

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/lib-DuDqLKFD.mjsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib-DuDqLKFD.mjsView on unpkg · L1

dist/git-handle-CH1DpBYP.mjsView file

Lines 1-10javascript

1import{i as e,o as t,t as n}from"./chunk-DTipWd-i.mjs";import{Do as r}from"./src-RGB2pEts.mjs";import{delimiter as i,normalize as a,resolve as o}from"node:path"

dist/src-BVxZYLJj.mjsView file

High

Shell

Package source references shell execution.

dist/src-BVxZYLJj.mjsView on unpkg · L20

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src-BVxZYLJj.mjsView on unpkg · L1

dist/chunk-5QMZ5MUS-D8tv8KWc.mjsView file

Lines 1-5javascript

dist/public/assets/src-gXOrH5MP.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/public/assets/src-gXOrH5MP.jsView on unpkg · L2

dist/native/native-config.linux-arm64-musl.nodeView file

•path = dist/native/native-config.linux-arm64-musl.node kind = native_binary sizeBytes = 788152 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/native-config.linux-arm64-musl.nodeView on unpkg

dist/dist-bundle-CFfKBclM.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/dist-bundle-CFfKBclM.mjsView on unpkg

dist/native/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/native/index.jsView on unpkg

dist/js-exec-VXN6TZ7U-BrugyKqi.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/js-exec-VXN6TZ7U-BrugyKqi.mjsView on unpkg

dist/open-browser-CtVpc_8x.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/open-browser-CtVpc_8x.mjsView on unpkg

dist/chunk-HOUHSVGY-C3h3PdhC.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-HOUHSVGY-C3h3PdhC.mjsView on unpkg

dist/chunk-PUDLZKDR-CIWYIjrF.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/chunk-PUDLZKDR-CIWYIjrF.mjsView on unpkg

@inkeep/open-knowledge@0.53.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code