@knockdata/objectexplorer@0.5.6: Malicious npm security report | LPM Firewall

Loading npm security reports…

@knockdata/objectexplorer@0.5.6: Malicious npm security report | LPM Firewall

Source & flagged code

21 flagged · loading source

app/assets/WorkerParser.jsView file

51`),t=t.replace(Em,`�`),e.src=t}function Om(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L52: `,o.map=[t,e.line],!0}function th(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L53: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.2 matchedPath = app/assets/WorkerParser.js matchedIdentity = npm:[redacted]:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @knockdata/objectexplorer@0.4.7 matchedIdentity = npm:[redacted]:0.4.7 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/WebServer.mjsView on unpkg

461left join latest on latest.objectId = c.objectId L462: where c.reads > 0`).map(r=>({...r,path:e.objectPath(r.objectId)}))}var ire,FI=ne(()=>{Pi();qc();ire=300;i(RUe,"slotOf");i(oC,"recordAccess");i(ore,"accessRollup")});import sre from... L463: tell application "Terminal"

High

Shell

Package source references shell execution.

server/WebServer.mjsView on unpkg · L461

461left join latest on latest.objectId = c.objectId L462: where c.reads > 0`).map(r=>({...r,path:e.objectPath(r.objectId)}))}var ire,FI=ne(()=>{Pi();qc();ire=300;i(RUe,"slotOf");i(oC,"recordAccess");i(ore,"accessRollup")});import sre from... L463: tell application "Terminal"

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server/WebServer.mjsView on unpkg · L461

app/assets/esm-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.2 matchedPath = app/assets/esm-worker.js matchedIdentity = npm:[redacted]:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/esm-worker.jsView on unpkg

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`RE...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/assets/esm-worker.jsView on unpkg · L1

app/assets/index.jsView file

682contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,k$(o,`normal`)).call(M$,f).node()}var r0=new Map([[`symbol`,Hye],[`color`,a0],[`opacity`,Wye]]);function Uye(e,t,n={}){return(r,a)=>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L682

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.2 matchedPath = cli.js matchedIdentity = npm:[redacted]:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/browser.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.2 matchedPath = app/assets/browser.js matchedIdentity = npm:[redacted]:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/browser.jsView on unpkg

app/assets/wasm-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.2 matchedPath = app/assets/wasm-worker.js matchedIdentity = npm:[redacted]:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/wasm-worker.jsView on unpkg

app/assets/AudioConverterWorker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.2 matchedPath = app/assets/AudioConverterWorker.js matchedIdentity = npm:[redacted]:0.5.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/AudioConverterWorker.jsView on unpkg