@knockdata/objectexplorer@0.4.3: Clean npm security report | LPM Firewall

Loading npm security reports…

@knockdata/objectexplorer@0.4.3: Clean npm security report | LPM Firewall

Source & flagged code

12 flagged · loading source

app/assets/WorkerParser.jsView file

48`),t=t.replace(vm,`�`),e.src=t}function bm(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L49: `,o.map=[t,e.line],!0}function qm(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L50: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L48

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

1Source sends the broad process environment to a literal external destination. L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var hEe=Object.create;var P4=Object.defineProperty;var gEe=Object.getOwnPropertyDescriptor;var _Ee=Object.getOwnPropertyNames;var bEe=Object.getPrototypeOf,EEe=Object.prototype.has... L3: `+qz(t,r.offset));let n=l1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi... L4: `+qz(t,a.offset,a.len))}return n.value}function qz(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L5: ${"".padEnd(t)}${"^".repeat(r)}`}function Kz(e){return dve(Xx,e)}function al(e){if(!e.type)throw new Error("

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjsView on unpkg · L1

351distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Shell

Package source references shell execution.

server/WebServer.mjsView on unpkg · L351

351distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/WebServer.mjsView on unpkg · L351

351distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

server/WebServer.mjsView on unpkg · L351

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var hEe=Object.create;var P4=Object.defineProperty;var gEe=Object.getOwnPropertyDescriptor;var _Ee=Object.getOwnPropertyNames;var bEe=Object.getPrototypeOf,EEe=Object.prototype.has... L3: `+qz(t,r.offset));let n=l1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi... L4: `+qz(t,a.offset,a.len))}return n.value}function qz(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L5: ${"".padEnd(t)}${"^".repeat(r)}`}function Kz(e){return dve(Xx,e)}function al(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return V4(e.na... L6

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

server/WebServer.mjsView on unpkg · L1

1Cross-file remote execution chain: server/WebServer.mjs spawns app/assets/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var hEe=Object.create;var P4=Object.defineProperty;var gEe=Object.getOwnPropertyDescriptor;var _Ee=Object.getOwnPropertyNames;var bEe=Object.getPrototypeOf,EEe=Object.prototype.has... L3: `+qz(t,r.offset));let n=l1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi... L4: `+qz(t,a.offset,a.len))}return n.value}function qz(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L5: ${"".padEnd(t)}${"^".repeat(r)}`}function

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server/WebServer.mjsView on unpkg · L1

351Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs L351: distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

server/WebServer.mjsView on unpkg · L351

app/assets/esm-worker.jsView file

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`RE...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/assets/esm-worker.jsView on unpkg · L1

app/assets/index.jsView file

1925contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,aV(o,`normal`)).call(lV,f).node()}var FU=new Map([[`symbol`,NU],[`color`,RU],[`opacity`,zU]]);function IU(e,t,n={}){return(r,a)=>{if

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L1925

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @knockdata/objectexplorer@0.4.2 matchedIdentity = npm:[redacted]:0.4.2 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

Source & flagged code

12 flagged

app/assets/WorkerParser.jsView file

48`),t=t.replace(vm,`�`),e.src=t}function bm(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L49: `,o.map=[t,e.line],!0}function qm(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L50: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L48

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

1Source sends the broad process environment to a literal external destination. L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var hEe=Object.create;var P4=Object.defineProperty;var gEe=Object.getOwnPropertyDescriptor;var _Ee=Object.getOwnPropertyNames;var bEe=Object.getPrototypeOf,EEe=Object.prototype.has... L3: `+qz(t,r.offset));let n=l1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi... L4: `+qz(t,a.offset,a.len))}return n.value}function qz(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L5: ${"".padEnd(t)}${"^".repeat(r)}`}function Kz(e){return dve(Xx,e)}function al(e){if(!e.type)throw new Error("

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjsView on unpkg · L1

351distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Shell

Package source references shell execution.

server/WebServer.mjsView on unpkg · L351

351distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/WebServer.mjsView on unpkg · L351

351distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

server/WebServer.mjsView on unpkg · L351

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var hEe=Object.create;var P4=Object.defineProperty;var gEe=Object.getOwnPropertyDescriptor;var _Ee=Object.getOwnPropertyNames;var bEe=Object.getPrototypeOf,EEe=Object.prototype.has... L3: `+qz(t,r.offset));let n=l1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi... L4: `+qz(t,a.offset,a.len))}return n.value}function qz(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L5: ${"".padEnd(t)}${"^".repeat(r)}`}function Kz(e){return dve(Xx,e)}function al(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return V4(e.na... L6

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

server/WebServer.mjsView on unpkg · L1

1Cross-file remote execution chain: server/WebServer.mjs spawns app/assets/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var hEe=Object.create;var P4=Object.defineProperty;var gEe=Object.getOwnPropertyDescriptor;var _Ee=Object.getOwnPropertyNames;var bEe=Object.getPrototypeOf,EEe=Object.prototype.has... L3: `+qz(t,r.offset));let n=l1(e)({tokens:r.tokens,options:void 0},0);if(!n.matched)throw new Error(`No match for "${t}" input!`);if(n.position<r.tokens.length){let a=r.tokens[n.positi... L4: `+qz(t,a.offset,a.len))}return n.value}function qz(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L5: ${"".padEnd(t)}${"^".repeat(r)}`}function

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server/WebServer.mjsView on unpkg · L1

351Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs L351: distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L352: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L353: `).slice(0,3).join(`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

server/WebServer.mjsView on unpkg · L351

app/assets/esm-worker.jsView file

Lines 1-1javascript

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.

app/assets/index.jsView file

1925contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,aV(o,`normal`)).call(lV,f).node()}var FU=new Map([[`symbol`,NU],[`color`,RU],[`opacity`,zU]]);function IU(e,t,n={}){return(r,a)=>{if

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L1925

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @knockdata/objectexplorer@0.4.2 matchedIdentity = npm:[redacted]:0.4.2 similarity = 0.885 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg