Loading npm security reports…

@knockdata/objectexplorer@0.5.9: Malicious npm security report | LPM Firewall

registry / @knockdata/objectexplorer / 0.5.9

@knockdata/objectexplorer@0.5.9

The VSCode for Cloud Storage — Explore, Analyze, Search your cloud storage locally with single click

AI Security Review

scanned 3h ago · by lpm-firewall-ai

A development-mode server exposes a subscription endpoint unrelated to ObjectExplorer. A download subscription stores the caller's email and IP address and sends a third-party promotional email.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Run the server in development mode with user data, then submit a download subscription request.

Impact

User email addresses and IP addresses are recorded locally and used to contact awheelmaker.com.

Mechanism

Collects subscription data and sends it through a hardcoded mail-service account.

Attack narrative

The bundled server adds a development-only subscription API that is unrelated to cloud-storage exploration. Its download path accepts email and name fields, records the submitted email and client IP in subscription files, and calls an email routine. That routine constructs a link to awheelmaker.com and sends a marketing email using an embedded third-party mail-service credential. This is concrete collection and external use of user-provided data under an unrelated package identity.

Rationale

The unrelated awheelmaker subscription and mailing workflow, plus the embedded mail-service credential, establishes intentional data collection and third-party outreach. The absence of an install hook limits activation but does not remove the malicious runtime behavior.

Evidence

server/WebServer.mjssubscriptions.jsonnotifiedSubscriptions.jsonconfirmedSubscriptions.jsonloves.json

Network endpoints1

Source & flagged code

23 flagged · loading source

app/assets/WorkerParser.jsView file

51`),t=t.replace(Dm,`�`),e.src=t}function km(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L52: `,o.map=[t,e.line],!0}function nh(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L53: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.6 matchedPath = app/assets/WorkerParser.js matchedIdentity = npm:[redacted]:0.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var s3e=Object.create;var R6=Object.defineProperty;var l3e=Object.getOwnPropertyDescriptor;var c3e=Object.getOwnPropertyNames;var u3e=Object.getPrototypeOf,d3e=Object.prototype.has... L3: `)}function tn(...e){let t=D6(2,"info");process.stderr.write(` L4: ${t.link} ${I6(e)}`),N6("INFO ",e,t.short)}function pi(...e){let t=D6(2,"warn");process.stderr.write(` ... L8: `+oH(t,a.offset,a.len))}return n.value}function oH(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function pH(e){return gwe(kR,e)}function _l(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return $6(e.na... L10: `.repea

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> server/WebServer.mjs L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var s3e=Object.create;var R6=Object.defineProperty;var l3e=Object.getOwnPropertyDescriptor;var c3e=Object.getOwnPropertyNames;var u3e=Object.getPrototypeOf,d3e=Object.prototype.has... L3: `)}function tn(...e){let t=D6(2,"info");process.stderr.write(` L4: ${t.link} ${I6(e)}`),N6("INFO ",e,t.short)}function pi(...e){let t=D6(2,"warn");process.stderr.write(` ... L8: `+oH(t,a.offset,a.len))}return n.value}function oH(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,a,o)=>a?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function pH(e){return gwe(kR,e)}function _l(e){if(!e.type)throw new Error("This is not an AST node."

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

app/assets/esm-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.6 matchedPath = app/assets/esm-worker.js matchedIdentity = npm:[redacted]:0.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/esm-worker.jsView on unpkg

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`RE...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/assets/esm-worker.jsView on unpkg · L1

app/assets/index.jsView file

690contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,g4(o,`normal`)).call(y4,f).node()}var W3=new Map([[`symbol`,Fwe],[`color`,K3],[`opacity`,Lwe]]);function Iwe(e,t,n={}){return(r,a)=>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L690

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.6 matchedPath = cli.js matchedIdentity = npm:[redacted]:0.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/browser.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.6 matchedPath = app/assets/browser.js matchedIdentity = npm:[redacted]:0.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/browser.jsView on unpkg

app/assets/wasm-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.6 matchedPath = app/assets/wasm-worker.js matchedIdentity = npm:[redacted]:0.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/wasm-worker.jsView on unpkg

app/assets/AudioConverterWorker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.6 matchedPath = app/assets/AudioConverterWorker.js matchedIdentity = npm:[redacted]:0.5.6 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/AudioConverterWorker.jsView on unpkg