@javascribe/pindoupic@0.3.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@javascribe/pindoupic@0.3.0: Malicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/mcp.jsView file

1#!/usr/bin/env node L2: import{Server as v2}from"@[redacted].js";import{StdioServerTransport as A2}from"@[redacted].js";import{CallToolRequestSchema a... L3: return ${a2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u988...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp.jsView on unpkg · L1

2https://pindoupic.com/api/v1",a2="__PINDOUPIC_ALGO__";async function ve(){return k||(k=(async()=>{let r=await e2(new URL("./core.enc.json",import.meta.url),"utf8"),a;try{a=await fetch(`${r2}/crypto/algo-key`,{signal:AbortSignal.timeout(8e3)})}catch(t){throw new Error(`\u65E0\u6CD5\u8FDE\u63A5 pindoupic.com \u83B7\u53D6\u7B97\u6CD5\u5BC6\u94A5\uFF08${t?.name||t?.message}\uFF09\u3002\u672C\u5DE5\u5177\u7684\u7B97\u6CD5\u4EE3\u7801\u662F\u52A0\u5BC6\u5206\u53D1\u7684\uFF0C\u5FC5\u987B\u5728\u7EBF\u53D6\u5BC6\u94A5\u62

High

Ai Review Evidence

Both executable entrypoints fetch a decryption key from the package service.

dist/mcp.jsView on unpkg · L2

2new Function(`${l} return ${a2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u67

High

Ai Review Evidence

The MCP entrypoint decrypts bundled opaque data and executes the resulting text with the Function constructor.

dist/mcp.jsView on unpkg · L2

3await ve(),o=await be(r.input),s=await te(o,a,r.resizeMode||"smooth"),{rgb:l,alpha:H}=Be(s.pixels,s.width,s.height),t=new L(s.width,s.height,s.pixels),G=r.paletteColors.m

High

Ai Review Evidence

Pattern generation activates the MCP decryption-and-execution routine.

dist/mcp.jsView on unpkg · L3

1#!/usr/bin/env node L2: import{Server as v2}from"@[redacted].js";import{StdioServerTransport as A2}from"@[redacted].js";import{CallToolRequestSchema a... L3: return ${a2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u988...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L1

dist/cli.jsView file

2core.enc.json",import.meta.url),"utf8"),r;try{r=await fetch(`${r2}/crypto/algo-key`,{signal:AbortSignal.timeout(8e3)})}catch(b){throw new Error(`\u65E0\u6CD5\u8FDE\u63A5 pindoupic.com \u83B7\u53D6\u7B97\u6CD5\u5BC6\u94A5\uFF08${b?.name||b?.message}\uFF09\u3002\u672C\u5DE5\u5177\u7684\u7B97\u6CD5\u4EE3\u7801\u662F\u52A0\u5BC6\u5206\u53D1\u7684\uFF0C\u5FC5\u987B\u5728\u7EBF\u53D6\u5BC6\u94A5\u624D\u80FD\u751F\u6210\u56FE\u7EB8\uFF1B\u7F51\u7AD9\u6062\u590D\u540E\u5373\u53EF\u6B63\u5E38\u4F7F\u7528\u3002\u5982\u9700\u81EA\u6258\u7BA1\uFF

High

Ai Review Evidence

Both executable entrypoints fetch a decryption key from the package service.

dist/cli.jsView on unpkg · L2

2new Function(`${n} return ${_2};`)();if(!p||typeof p.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u67

High

Ai Review Evidence

The MCP entrypoint decrypts bundled opaque data and executes the resulting text with the Function constructor.

dist/cli.jsView on unpkg · L2

dist/core.enc.jsonView file

1{"iv":"[redacted]","data":"[redacted]

High

Ai Review Evidence

The encrypted payload is included as a large opaque data file.

dist/core.enc.jsonView on unpkg · L1

Source & flagged code

8 flagged

dist/mcp.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2import{Server as v2}from"@modelcontextprotocol/sdk/server/index.js";import{StdioServerTransport as A2}from"@modelcontextprotocol/sdk/server/stdio.js";import{CallToolRequestSchema as p2,ListToolsRequestSchema as f2}from"@modelcontextprotocol/sdk/types.js";import _2 from"sharp";import Ce from"sharp";var L=class{width;height;_pixels;constructor(a,e,_){this.width=a,this.height=e,this._pixels=_||null}getContext(a,e){return new se(this)}},se=class{_canvas;imageSmoothingEnabled=!0;imageSmoothingQuality="high";constructor(a){this._canvas=a}getImageData(a,e,_,d){let o=this._canvas._pixels;return{data:o ...

High

Ai Review Evidence

Both executable entrypoints fetch a decryption key from the package service.

dist/mcp.jsView on unpkg · L2

3return ${a2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u9884\u671F\u63A5\u53E3\uFF09");return H})(),k.catch(()=>{k=null}),k)}var k=null;var d2=50,s2={1:.6,2:.7,3:.9},Ae=.72,he=.5,i2=1,h2=.4,o2=8;async function pe(r){let a=r.width||50;if(a<10||a>150)throw new Error("width must be 10-150");let{generatePattern:e,buildColorStats:_,rgbToLab:d}=await ve(),o=await be(r.input),s=await te(o,a,r.resizeMode||"smooth"),{rgb:l,alpha:H}=Be(s.pixels,s.width,s.height),t=new L(s.width,s.heig ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp.jsView on unpkg · L1

High

Ai Review Evidence

The MCP entrypoint decrypts bundled opaque data and executes the resulting text with the Function constructor.

dist/mcp.jsView on unpkg · L2

High

Ai Review Evidence

Pattern generation activates the MCP decryption-and-execution routine.

dist/mcp.jsView on unpkg · L3

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L1

4`)}let ne=S+w+xe+Ie+ce,x=[];if(x.push(`<svg xmlns="http://www.w3.org/2000/svg" width="${P}" height="${ne}">`),s&&e>=10){x.push("<defs>");for(let

5`),re=await _2(Buffer.from(Ne)).png().toBuffer();if(G==="pdf"){let{execSync:i}=await import("node:child_process"),{mkdtempSync:m,writeFileSync:h,readFileSync:u,rmSync:b}=await import("node:fs"),{tmpdir:v}=await import("node:os"),{join:A}=await import("node:path"),K=m(A(v(),"pindoupic-pdf-")),Z=A(K,"temp.png"),$=A(K,"output.pdf");try{return h(Z,re),i(`sips -s format pdf "${Z}" --out "${$}"`,{timeout:1e4}),u($)}catch(Y){return console.error(`\u26A0 PDF conversion failed: ${Y.message}. Falling back to PNG.`),re}finally{b(K,{recursive:!0,force:!0})}}return re}var fe={brand:"mard",display_name:"MAR ...

6

7\u53C2\u6570\uFF1A

8- image_url / image_base64 / image_path: \u56FE\u7247\u6765\u6E90\uFF08\u4E09\u9009\u4E00\uFF0C\u672C\u673A\u6587\u4EF6\u63A8\u8350\u7528 image_path\uFF09

9- width: \u56FE\u7EB8\u5BBD\u5EA6 10-150\uFF08\u9ED8\u8BA4 ${z.default_width}\uFF0C\u53EF\u7531\u540E\u53F0\u53C2\u6570\u8986\u76D6\uFF09

10- palette_brand: \u8272\u677F\u54C1\u724C\uFF08\u9ED8\u8BA4 MARD\uFF09

11- palette_sub: \u8272\u677F\u578B\u53F7\uFF08\u9ED8\u8BA4 291\uFF0C\u53EF\u9009\u503C\u89C1 list_palettes\uFF09

12- image_type: \u56FE\u7247\u7C7B\u578B\u9884\u8BBE\uFF08\u9ED8\u8BA4 miniapp_fast \u5C0F\u7A0B\u5E8F\u6781\u901F\u6A21\u5F0F\uFF09\uFF1A${W.map(r=>r.id).join("|")}`,inputSchema:{type:"object",properties:{image_url:{type:"string",

13

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import d2 from"sharp";import be from"sharp";var Z=class{width;height;_pixels;constructor(r,a,

dist/core.enc.jsonView file

Lines 1-1json

1{"iv":"ba3aea6304fd5ca5aa1f41d2abdacd63","data":"2e4bfcd3923ea05f8a814621723181c47417c4ad2ac017ef52d97e89035334da2b10788bdb6aec72a50966b3f80f76af8cd55e18e1e5411cb2e890852ec345cc0365adb8766581417eb340c96b8abc6357b66548363dcc8e20580df3e6c0bab4f96f1ad4fd2203900c9093e63b6cd24cbca134e6496a05c050c7638489290708c73e079778ae5593d2c6cfb4909437665bf3cd6f3ba44b6aa118e004d7a32dabf2a5c969e4e2fdd3f414bf7e84642c819a222e6f990e411054dfee1622c41e7b2dd9ce6d9eddc1fc63b62535c8ce8c4a7ba7188ae0e6c6d3226c91113708a5e4f8815030c72557470771c671bc26adb376cce02f3ebace9affe3ca00d900b9671c817381a7b002f78523cae7df81de0b81edd64 ...

High

Ai Review Evidence

The encrypted payload is included as a large opaque data file.

dist/core.enc.jsonView on unpkg · L1

Long lines were clipped for display.