Loading npm security reports…

@knockdata/objectexplorer@0.5.2: Malicious npm security report | LPM Firewall

registry / @knockdata/objectexplorer / 0.5.2

@knockdata/objectexplorer@0.5.2

The VSCode for Cloud Storage — Explore, Analyze, Search your cloud storage locally with single click

AI Security Review

scanned 2h ago · by lpm-firewall-ai

A hidden development-mode API collects subscription request data and can send third-party branded email. This functionality is unrelated to the declared cloud-storage explorer.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

Start WebServer in development mode with a dataDir, then submit a download-type request to /api/subscribe.

Impact

Can collect visitor identifiers locally and use embedded email-service access to send unsolicited third-party messages.

Mechanism

Collect request data and send a Resend email linking to awheelmaker.com.

Attack narrative

When the server is started in development mode with a data directory, it enables a hidden subscription API. A request to /api/subscribe records the supplied email, name, IP address, and fields. If the request type is download, the server sends an A Wheel Maker email to that address containing a link to awheelmaker.com. This unrelated data collection and outbound email capability is embedded in a package marketed as a cloud-storage explorer.

Rationale

The concealed third-party subscription and email subsystem is concrete, externally acting behavior unrelated to the package purpose. Its activation is guarded but source-complete and includes collection plus outbound messaging.

Evidence

server/WebServer.mjssubscriptions.jsonnotifiedSubscriptions.jsonconfirmedSubscriptions.jsonloves.json

Network endpoints1

awheelmaker.com/

Source & flagged code

14 flagged · loading source

app/assets/WorkerParser.jsView file

51`),t=t.replace(Em,`�`),e.src=t}function Om(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L52: `,o.map=[t,e.line],!0}function th(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L53: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @knockdata/objectexplorer@0.4.7 matchedIdentity = npm:[redacted]:0.4.7 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/WebServer.mjsView on unpkg

374distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal"

High

Shell

Package source references shell execution.

server/WebServer.mjsView on unpkg · L374

374distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/WebServer.mjsView on unpkg · L374

374distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal" ... L380: end tell L381: end tell`.replace(/'/g,"'\\''")}'`;dv(n)}else if(lI==="win32")dv(`start cmd.exe /k ${e}`);else{let t=e.replace(/'/g,"'\\''");dv(`x-terminal-emulator -e bash -c '${t}; exec bash'`,f... L382: `));if(!v)return null;be=Be(v,!0)}return be.shift()},"FS_stdin_getChar"),Ue={ttys:[],init(){},shutdown(){},register(v,D){Ue.ttys[v]={input:[],output:[],ops:D},j.registerDevice(v,Ue...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

server/WebServer.mjsView on unpkg · L374

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var a6e=Object.create;var o6=Object.defineProperty;var i6e=Object.getOwnPropertyDescriptor;var o6e=Object.getOwnPropertyNames;var s6e=Object.getPrototypeOf,l6e=Object.prototype.has... L3: `)}function In(...e){let t=s6(2,"info");process.stderr.write(` L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function oi(...e){let t=s6(2,"warn");process.stderr.write(` ... L8: `+XG(t,a.offset,a.len))}return n.value}function XG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function nq(e){return f3e(JA,e)}function pl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return b6(e.na... L10: `.repea

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

server/WebServer.mjsView on unpkg · L1

14`).map(o=>"> "+o).join(` L15: `),"blockTransform")})}function AR(e,t){if(!t)return e;let r=typeof t[0]=="string"?t[0]:"[",n=typeof t[1]=="string"?t[1]:"]";return r+e+n}function Jq(e,t,r,n,a){let o=typeof t=="fu... L16: `)}splitLongWord(t){let r=[],n=0;for(;t.length>this.maxLineLength;){let a=t.substring(0,this.maxLineLength),o=t.substring(this.maxLineLength),s=a.lastIndexOf(this.wrapCharacters[n]... ... L193: Error generating stack: `+W.message+` L194: `+W.stack}}i(cb,"getStackByComponentStackNode");var nm=n.ReactCurrentDispatcher,oc=n.ReactDebugCurrentFrame,Wh=0,Eu=1,ub=2,G4=3,db=4,Xd=0,q4=1,Zd=2,am=12800;function H4(E){return c... L195: `));if(!y)return null;Ce=He(y,!0)}return Ce.shift()},"FS_stdin_getChar"),et={ttys:[],init(){},shutdown(){},register(y,O){et.ttys[y]={input:[],output

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

server/WebServer.mjsView on unpkg · L14

1Cross-file remote execution chain: server/WebServer.mjs spawns app/assets/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var a6e=Object.create;var o6=Object.defineProperty;var i6e=Object.getOwnPropertyDescriptor;var o6e=Object.getOwnPropertyNames;var s6e=Object.getPrototypeOf,l6e=Object.prototype.has... L3: `)}function In(...e){let t=s6(2,"info");process.stderr.write(` L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function oi(...e){let t=s6(2,"warn");process.stderr.write(` ... L8: `+XG(t,a.offset,a.len))}return n.value}function XG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function nq(e){retu

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server/WebServer.mjsView on unpkg · L1

374Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs L374: distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal" ... L380: end tell L381: end tell`.replace(/'/g,"'\\''")}'`;dv(n)}else if(lI==="win32")dv(`start cmd.exe /k ${e}`);else{let t=e.replace(/'/g,"'\\''");dv(`x-terminal-emulator -e bash -c '${t}; exec bash'`,f... L382: `));if(!v)return null;be=Be(v,!0)}return be.shift()},"FS_stdin_getChar"),Ue={ttys:[],init(){},shutdown(){},register(v,D){Ue.ttys[v]={input:[],output:[],ops:D},j.registerDevice

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

server/WebServer.mjsView on unpkg · L374

app/assets/esm-worker.jsView file

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`RE...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/assets/esm-worker.jsView on unpkg · L1

app/assets/index.jsView file

2390contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,r0(o,`normal`)).call(o0,f).node()}var j2=new Map([[`symbol`,Exe],[`color`,N2],[`opacity`,Oxe]]);function Dxe(e,t,n={}){return(r,a)=>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L2390

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

Source & flagged code

14 flagged

app/assets/WorkerParser.jsView file

51`),t=t.replace(Em,`�`),e.src=t}function Om(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L52: `,o.map=[t,e.line],!0}function th(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L53: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @knockdata/objectexplorer@0.4.7 matchedIdentity = npm:[redacted]:0.4.7 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/WebServer.mjsView on unpkg

374distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal"

High

Shell

Package source references shell execution.

server/WebServer.mjsView on unpkg · L374

374distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/WebServer.mjsView on unpkg · L374

374distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal" ... L380: end tell L381: end tell`.replace(/'/g,"'\\''")}'`;dv(n)}else if(lI==="win32")dv(`start cmd.exe /k ${e}`);else{let t=e.replace(/'/g,"'\\''");dv(`x-terminal-emulator -e bash -c '${t}; exec bash'`,f... L382: `));if(!v)return null;be=Be(v,!0)}return be.shift()},"FS_stdin_getChar"),Ue={ttys:[],init(){},shutdown(){},register(v,D){Ue.ttys[v]={input:[],output:[],ops:D},j.registerDevice(v,Ue...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

server/WebServer.mjsView on unpkg · L374

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var a6e=Object.create;var o6=Object.defineProperty;var i6e=Object.getOwnPropertyDescriptor;var o6e=Object.getOwnPropertyNames;var s6e=Object.getPrototypeOf,l6e=Object.prototype.has... L3: `)}function In(...e){let t=s6(2,"info");process.stderr.write(` L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function oi(...e){let t=s6(2,"warn");process.stderr.write(` ... L8: `+XG(t,a.offset,a.len))}return n.value}function XG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function nq(e){return f3e(JA,e)}function pl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return b6(e.na... L10: `.repea

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

server/WebServer.mjsView on unpkg · L1

14`).map(o=>"> "+o).join(` L15: `),"blockTransform")})}function AR(e,t){if(!t)return e;let r=typeof t[0]=="string"?t[0]:"[",n=typeof t[1]=="string"?t[1]:"]";return r+e+n}function Jq(e,t,r,n,a){let o=typeof t=="fu... L16: `)}splitLongWord(t){let r=[],n=0;for(;t.length>this.maxLineLength;){let a=t.substring(0,this.maxLineLength),o=t.substring(this.maxLineLength),s=a.lastIndexOf(this.wrapCharacters[n]... ... L193: Error generating stack: `+W.message+` L194: `+W.stack}}i(cb,"getStackByComponentStackNode");var nm=n.ReactCurrentDispatcher,oc=n.ReactDebugCurrentFrame,Wh=0,Eu=1,ub=2,G4=3,db=4,Xd=0,q4=1,Zd=2,am=12800;function H4(E){return c... L195: `));if(!y)return null;Ce=He(y,!0)}return Ce.shift()},"FS_stdin_getChar"),et={ttys:[],init(){},shutdown(){},register(y,O){et.ttys[y]={input:[],output

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

server/WebServer.mjsView on unpkg · L14

1Cross-file remote execution chain: server/WebServer.mjs spawns app/assets/index.js; helper contains network access plus dynamic code execution. L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var a6e=Object.create;var o6=Object.defineProperty;var i6e=Object.getOwnPropertyDescriptor;var o6e=Object.getOwnPropertyNames;var s6e=Object.getPrototypeOf,l6e=Object.prototype.has... L3: `)}function In(...e){let t=s6(2,"info");process.stderr.write(` L4: ${t.link} ${c6(e)}`),u6("INFO ",e,t.short)}function oi(...e){let t=s6(2,"warn");process.stderr.write(` ... L8: `+XG(t,a.offset,a.len))}return n.value}function XG(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function nq(e){retu

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server/WebServer.mjsView on unpkg · L1

374Trigger-reachable command-output exfiltration chain: manifest.main -> server/WebServer.mjs L374: distinctCount, minValue, q1_value, medianValue, q3_value, maxValue, avgValue, topValues) L375: values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,[l.objectId,u.name,c,o,d.kind,d.rowCount,d.validCount,d.nullCount,d.distinctCount,d.minValue,d.q1_value,d.medianValue,d.q3_... L376: tell application "Terminal" ... L380: end tell L381: end tell`.replace(/'/g,"'\\''")}'`;dv(n)}else if(lI==="win32")dv(`start cmd.exe /k ${e}`);else{let t=e.replace(/'/g,"'\\''");dv(`x-terminal-emulator -e bash -c '${t}; exec bash'`,f... L382: `));if(!v)return null;be=Be(v,!0)}return be.shift()},"FS_stdin_getChar"),Ue={ttys:[],init(){},shutdown(){},register(v,D){Ue.ttys[v]={input:[],output:[],ops:D},j.registerDevice

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

server/WebServer.mjsView on unpkg · L374

app/assets/esm-worker.jsView file

Lines 1-1javascript

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.

app/assets/index.jsView file

2390contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,r0(o,`normal`)).call(o0,f).node()}var j2=new Map([[`symbol`,Exe],[`color`,N2],[`opacity`,Oxe]]);function Dxe(e,t,n={}){return(r,a)=>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L2390

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg