Loading npm security reports…

@knockdata/objectexplorer@0.6.2: Malicious npm security report | LPM Firewall

registry / @knockdata/objectexplorer / 0.6.2

@knockdata/objectexplorer@0.6.2

The VSCode for Cloud Storage — Explore, Analyze, Search your cloud storage locally with single click

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

A hidden development-mode service collects submitted email addresses and client IP addresses. It sends an unrelated A Wheel Maker email containing a recipient-specific external link.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Start the server in development mode and submit a POST request to /api/subscribe with type set to download.

Impact

Submitted contact and network data are persisted locally and used to contact recipients through an unrelated external service.

Mechanism

Unrelated subscription data collection and third-party email delivery.

Attack narrative

The product's bundled server includes an unrelated A Wheel Maker subscription API. In development mode it mounts /api/subscribe, stores submitted email and client IP data, and for download requests sends a mail containing an awheelmaker.com link through a hard-coded mail-service credential. This concealed, unrelated collection and outbound-contact capability is a concrete malicious payload even though the normal CLI defaults to production mode.

AI rationale

The hidden subscription and outbound-email functionality is unrelated to a cloud-storage explorer and processes user contact data. Its restricted development trigger reduces exposure but does not make the embedded payload benign.

Evidence

server/WebServer.mjssubscriptions.jsonnotifiedSubscriptions.json

Network endpoints2

awheelmaker.com/${t}?id=${r}api.resend.com

Source & flagged code

23 flagged

app/assets/WorkerParser.jsView file

51`),t=t.replace(Dm,`�`),e.src=t}function km(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L52: `,o.map=[t,e.line],!0}function nh(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L53: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.9 matchedPath = app/assets/WorkerParser.js matchedIdentity = npm:[redacted]:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var jxe=Object.create;var v6=Object.defineProperty;var Vxe=Object.getOwnPropertyDescriptor;var Yxe=Object.getOwnPropertyNames;var Wxe=Object.getPrototypeOf,Kxe=Object.prototype.has... L3: `)}function pn(...e){let t=y6(2,"info");process.stderr.write(` L4: ${t.link} ${w6(e)}`),C6("INFO ",e,t.short)}function Pn(...e){let t=y6(2,"warn");process.stderr.write(` ... L8: `+QV(t,i.offset,i.len))}return n.value}function QV(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,i,o)=>i?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function rY(e){return eAe(r7,e)}function yl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return k6(e.na... L10: `.repea

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> server/WebServer.mjs L1: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var jxe=Object.create;var v6=Object.defineProperty;var Vxe=Object.getOwnPropertyDescriptor;var Yxe=Object.getOwnPropertyNames;var Wxe=Object.getPrototypeOf,Kxe=Object.prototype.has... L3: `)}function pn(...e){let t=y6(2,"info");process.stderr.write(` L4: ${t.link} ${w6(e)}`),C6("INFO ",e,t.short)}function Pn(...e){let t=y6(2,"warn");process.stderr.write(` ... L8: `+QV(t,i.offset,i.len))}return n.value}function QV(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,i,o)=>i?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function rY(e){return eAe(r7,e)}function yl(e){if(!e.type)throw new Error("This is not an AST node."

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

app/assets/esm-worker.jsView file

Lines 1-1javascript

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.

app/assets/index.jsView file

880contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,E4(o,`normal`)).call(k4,f).node()}var e6=new Map([[`symbol`,kOe],[`color`,n6],[`opacity`,jOe]]);function AOe(e,t,n={}){return(r,a)=>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L880

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.9 matchedPath = cli.js matchedIdentity = npm:[redacted]:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/browser.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.9 matchedPath = app/assets/browser.js matchedIdentity = npm:[redacted]:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/browser.jsView on unpkg

app/assets/wasm-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.9 matchedPath = app/assets/wasm-worker.js matchedIdentity = npm:[redacted]:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/wasm-worker.jsView on unpkg

app/assets/AudioConverterWorker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.9 matchedPath = app/assets/AudioConverterWorker.js matchedIdentity = npm:[redacted]:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/AudioConverterWorker.jsView on unpkg

Source & flagged code

23 flagged · loading source

app/assets/WorkerParser.jsView file

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

app/assets/esm-worker.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.5.9 matchedPath = app/assets/esm-worker.js matchedIdentity = npm:[redacted]:0.5.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/esm-worker.jsView on unpkg

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`RE...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/assets/esm-worker.jsView on unpkg · L1

app/assets/index.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L880

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/browser.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/browser.jsView on unpkg

app/assets/wasm-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/wasm-worker.jsView on unpkg

app/assets/AudioConverterWorker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/AudioConverterWorker.jsView on unpkg

Source & flagged code

23 flagged

app/assets/WorkerParser.jsView file

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/WorkerParser.jsView on unpkg

server/WebServer.mjsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

app/assets/esm-worker.jsView file

Lines 1-1javascript

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.

app/assets/index.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L880

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/browser.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/browser.jsView on unpkg

app/assets/wasm-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/wasm-worker.jsView on unpkg

app/assets/AudioConverterWorker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/AudioConverterWorker.jsView on unpkg

@knockdata/objectexplorer@0.6.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code