@javascribe/pindoupic@0.5.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@javascribe/pindoupic@0.5.0: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/mcp.jsView file

1#!/usr/bin/env node L2: import{Server as O2}from"@[redacted].js";import{StdioServerTransport as U2}from"@[redacted].js";import{CallToolRequestSchema a... L3: return ${D2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u988...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp.jsView on unpkg · L1

2process.env.PINDOUPIC_API||"https://pindoupic.com/api/v1",D2="__PINDOUPIC_ALGO__";async function Re(){return J||(J=(async()=>{let r=await g2(new URL("./core.enc.json",import.meta.url),"utf8"),a;try{a=await fetch(`${E2}/crypto/algo-key`,{signal:AbortSignal.timeout(8e3)})}catch(v){throw new Error(`\u65E0\u6CD5\u8FDE\u63A5 pindoupic.com \u83B7\u53D6\u7B97\u6CD5\u5BC6\u94A5\uFF08${v?.name||v?.message}\uFF09\u3002\u672C\u5DE5\u5177\u7684\u7B97\u6CD5\u4EE3\u7801\u662F\u52A0\u5BC6\u5206\u53D1\u7684\uFF0C\u5FC5\u987B\u5728\u7EBF\u53D6\u5BC6\u94A5\u624D\u80FD\u75

Medium

Ai Review Evidence

The MCP entry point retrieves a decryption key from the configured service endpoint.

dist/mcp.jsView on unpkg · L2

25DF2\u62D2\u7EDD\u6267\u884C");let{iv:_,data:d,tag:h}=JSON.parse(r),o=u2("aes-256-gcm",Buffer.from(e,"hex"),Buffer.from(_,"hex"));o.setAuthTag(Buffer.from(h,"hex"));let F=Buffer.concat([o.update(Buffer.from(d,"hex")),o.final()]).toString("utf8"),H=new Function(`${F} return ${D2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89

Medium

Ai Review Evidence

It decrypts the bundled opaque payload and executes the resulting text with a dynamic function.

dist/mcp.jsView on unpkg · L2

3tats:_,rgbToLab:d,simplifyColors:h}=await Re(),o=await Me(r.input),F=await ye(o,a,r.resizeMode||"smooth"),{rgb:H,alpha:v}=Pe(F.pixels,F.width,F.height),G=new L(F.width,F.height,F.pixels),Q=r.paletteColors.map(t=>{let R=t.hex_value.replace("#",""),E=parseInt(R.slice(0,2),16),P=parseInt(R.slice(2,4),16),ge=parseInt(R.slice(4,6),16);return d(E,P,ge)}),C=e(G,a,r

Medium

Ai Review Evidence

Pattern generation invokes the payload loader before processing input.

dist/mcp.jsView on unpkg · L3

1#!/usr/bin/env node L2: import{Server as O2}from"@[redacted].js";import{StdioServerTransport as U2}from"@[redacted].js";import{CallToolRequestSchema a... L3: return ${D2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u988...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L1

package.jsonView file

1{ "name": "@javascribe/pindoupic", "version": "0.5.0", "description": "pindoupic 拼豆图纸生成器 — CLI + MCP Server 双模式；色板与预设内置，算法代码加密分发、密钥由 pindoupic.com 下发", "type": "module", "bin": {

Medium

Ai Review Evidence

The MCP entry point retrieves a decryption key from the configured service endpoint.

package.jsonView on unpkg · L1

Source & flagged code

6 flagged

dist/mcp.jsView file

Lines 1-13javascript

1#!/usr/bin/env node

2import{Server as O2}from"@modelcontextprotocol/sdk/server/index.js";import{StdioServerTransport as U2}from"@modelcontextprotocol/sdk/server/stdio.js";import{CallToolRequestSchema as Q2,ListToolsRequestSchema as V2}from"@modelcontextprotocol/sdk/types.js";import R2 from"sharp";import Ge from"sharp";var L=class{width;height;_pixels;constructor(a,e,_){this.width=a,this.height=e,this._pixels=_||null}getContext(a,e){return new xe(this)}},xe=class{_canvas;imageSmoothingEnabled=!0;imageSmoothingQuality="high";constructor(a){this._canvas=a}getImageData(a,e,_,d){let h=this._canvas._pixels;return{data:h ...

Medium

Ai Review Evidence

The MCP entry point retrieves a decryption key from the configured service endpoint.

dist/mcp.jsView on unpkg · L2

3return ${D2};`)();if(!H||typeof H.generatePattern!="function")throw new Error("\u7B97\u6CD5\u6A21\u5757\u521D\u59CB\u5316\u5931\u8D25\uFF08\u89E3\u5BC6\u540E\u672A\u5BFC\u51FA\u9884\u671F\u63A5\u53E3\uFF09");return H})(),J.catch(()=>{J=null}),J)}var J=null;var we={brand:"mard",display_name:"MARD",sub_palette:"24",sub_palette_name:"24\u8272\u5957\u88C5",colors:[{id:"mard_24_A4",code:"A4",name:"\u660E\u4EAE\u67E0\u6AAC\u9EC4",hex_value:"#FBED56",hex:"#FBED56",rgb:[251,237,86],series:"A"},{id:"mard_24_A6",code:"A6",name:"\u871C\u6A59\u8272",hex_value:"#FEAC4C",hex:"#FEAC4C",rgb:[254,172,76],serie ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/mcp.jsView on unpkg · L1

Medium

Ai Review Evidence

It decrypts the bundled opaque payload and executes the resulting text with a dynamic function.

dist/mcp.jsView on unpkg · L2

Medium

Ai Review Evidence

Pattern generation invokes the payload loader before processing input.

dist/mcp.jsView on unpkg · L3

4`)}let be=Math.max(9,Math.floor(6*A)),Be=Math.max(20,Math.floor(be*2.6)),_e=S+w+Ee+_2+Ce+Be,n

5`),se=await R2(Buffer.from(h2)).png().toBuffer();if(G==="pdf"){let{execSync:i}=await import("node:child_process"),{mkdtempSync:x,writeFileSync:s,readFileSync:g,rmSync:b}=await import("node:fs"),{tmpdir:p}=await import("node:os"),{join:f}=await import("node:path"),k=x(f(p(),"pindoupic-pdf-")),K=f(k,"temp.png"),$=f(k,"output.pdf");try{return s(K,se),i(`sips -s format pdf "${K}" --out "${$}"`,{timeout:1e4}),g($)}catch(Z){return console.error(`\u26A0 PDF conversion failed: ${Z.message}. Falling back

6

7\u53C2\u6570\uFF1A

8- image_url / image_base64 / image_path: \u56FE\u7247\u6765\u6E90\uFF08\u4E09\u9009\u4E00\uFF0C\u672C\u673A\u6587\u4EF6\u63A8\u8350\u7528 image_path\uFF09

9- width: \u56FE\u7EB8\u5BBD\u5EA6 ${B.min}-${B.max}\uFF08\u9ED8\u8BA4 ${z.default_width}\uFF0C\u53EF\u7531\u540E\u53F0\u53C2\u6570\u8986\u76D6\uFF09

10- palette_brand: \u8272\u677F\u54C1\u724C\uFF08\u9ED8\u8BA4 MARD\uFF09

11- palette_sub: \u8272\u677F\u578B\u53F7\uFF08\u9ED8\u8BA4 291\uFF0C\u53EF\u9009\u503C\u89C1 list_palettes\uFF09

12- image_type: \u56FE\u7247\u7C7B\u578B\u9884\u8BBE\uFF08\u9ED8\u8BA4 miniapp_fast \u5C0F\u7A0B\u5E8F\u6781\u901F\u6A21\u5F0F\uFF09\uFF1A${U.map(r=>r.id).join("|")}`,inputSchema:{type:"object",properties:{image_url:{type:"string",description:"\u56FE\u7247 URL\uFF08\u4E0E image_base64 / image_path \u4E09\u9009\u4E00\uFF09

13

Long lines were clipped for display.

package.jsonView file

Lines 1-21json

1{

2 "name": "@javascribe/pindoupic",

3 "version": "0.5.0",

4 "description": "pindoupic 拼豆图纸生成器 — CLI + MCP Server 双模式；色板与预设内置，算法代码加密分发、密钥由 pindoupic.com 下发",

5 "type": "module",

6