@javascribe/pindoupic: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@javascribe/pindoupic: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/mcp.jsView file

23098if (format === "pdf") { L23099: const { execFileSync } = await import("node:child_process"); L23100: const { mkdtempSync, writeFileSync: writeFileSync5, readFileSync: readFileSync6, rmSync: rmSync3 } = await import("node:fs");

High

Child Process

Package source references child process execution.

dist/mcp.jsView on unpkg · L23098

69const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L69

dist/cli.jsView file

25248function runCli(cmdline) { L25249: const r = spawnSync(cmdline, { encoding: "utf8", shell: true }); L25250: return { code: r.status === null ? 127 : r.status, out: `${r.stdout || ""}${r.stderr || ""}`.trim() };

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L25248

69const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L69

69Cross-file remote execution chain: dist/cli.js spawns dist/mcp.js; helper contains network access plus dynamic code execution. L69: const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L69

69const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L69

Source & flagged code

6 flagged

dist/mcp.jsView file

23098if (format === "pdf") { L23099: const { execFileSync } = await import("node:child_process"); L23100: const { mkdtempSync, writeFileSync: writeFileSync5, readFileSync: readFileSync6, rmSync: rmSync3 } = await import("node:fs");

High

Child Process

Package source references child process execution.

dist/mcp.jsView on unpkg · L23098

69const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L69

dist/cli.jsView file

25248function runCli(cmdline) { L25249: const r = spawnSync(cmdline, { encoding: "utf8", shell: true }); L25250: return { code: r.status === null ? 127 : r.status, out: `${r.stdout || ""}${r.stderr || ""}`.trim() };

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L25248

69const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L69

69Cross-file remote execution chain: dist/cli.js spawns dist/mcp.js; helper contains network access plus dynamic code execution. L69: const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L69

69const pixels = this._canvas._pixels; L70: if (!pixels) return { data: new Uint8ClampedArray(w * h * 4), width: w, height: h }; L71: const cw = this._canvas.width, ch = this._canvas.height; ... L6784: // src/core/algoEntry.ts L6785: function viaStderr(fn) { L6786: return function(...args) { L6787: const orig = console.log; L6788: const quiet = process.env.PINDOUPIC_QUIET === "1" || process.env.PINDOUPIC_QUIET === "true" || globalThis.__pdQuiet === true; L6789: console.log = quiet ? () => { ... L21937: try { L21938: raw = JSON.parse(readFileSync(file, "utf8")); L21939: } catch (e) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L69