Loading npm security reports…

@knockdata/objectexplorer@0.7.0: Malicious npm security report | LPM Firewall

registry / @knockdata/objectexplorer / 0.7.0

@knockdata/objectexplorer@0.7.0

The VSCode for Cloud Storage — Explore, Analyze, Search your cloud storage locally with single click

AI Security Review

scanned 26d ago · by lpm-firewall-ai

A hidden development-server API collects subscriber details and can email them through an unrelated external service. It is not part of the stated storage-explorer function.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

Starting WebServer in development mode with a data directory, then posting type=download to /api/subscribe.

Impact

Enables unsolicited or phishing-style email delivery and stores submitted personal data and IP addresses.

Mechanism

Collects subscription records and sends an external download email using an embedded mail-service credential.

Attack narrative

The server bundle includes a concealed subscription system for an unrelated A Wheel Maker site. In development mode it exposes /api/subscribe, saves request-supplied email, name, IP address, and other fields to local subscription files. When the request type is download, it sends an email linking to awheelmaker.com through a hard-coded mail-service credential. This functionality is unrelated to object exploration and creates a concrete phishing and personal-data collection capability.

AI rationale

The package has no install hook, but its shipped server contains an unrelated email and data-collection backdoor with an embedded credential. That concrete hidden capability warrants blocking publication.

Evidence

server/WebServer.mjssubscriptions.jsonconfirmedSubscriptions.jsonnotifiedSubscriptions.jsonloves.json

Network endpoints2

awheelmaker.com

Source & flagged code

26 flagged

app/assets/WorkerParser.jsView file

51`),t=t.replace(mm,`�`),e.src=t}function gm(e){let t;e.inlineMode?(t=new e.Token(`inline`,``,0),t.content=e.src,t.map=[0,1],t.children=[],e.tokens.push(t)):e.md.block.parse(e.src,e.... L52: `,o.map=[t,e.line],!0}function Wm(e,t,n,i){let a=e.bMarks[t]+e.tShift[t],o=e.eMarks[t];if(e.sCount[t]-e.blkIndent>=4||a+3>o)return!1;let s=e.src.charCodeAt(a);if(s!==126&&s!==96)re... L53: https://github.com/highlightjs/highlight.js/issues/2277`),a=e,i=t),n===void 0&&(n=!0);let o={code:i,language:a};ue(`before:highlight`,o);let s=o.result?o.result:b(o.language,o.code...

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

app/assets/esm-worker.jsView file

Lines 1-1javascript

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`READ_FILE`,e.DELETE_FILE=

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.6.2 matchedPath = app/assets/esm-worker.js matchedIdentity = npm:[redacted]:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/esm-worker.jsView on unpkg

server/WebServer.mjsView file

180`+ye:"",ze!==null?` L181: `+ze:""))}}}return $}a(ND,"constructClassInstance");function kD(y,R,H){{var X=pn(R)||"Component",_=y.render;_||(R.prototype&&typeof R.prototype.render=="function"?o("%s(...): No `r... L182: ... L193: Error generating stack: `+X.message+` L194: `+X.stack}}a(sS,"getStackByComponentStackNode");var km=n.ReactCurrentDispatcher,Sc=n.ReactDebugCurrentFrame,L1=0,Mu=1,lS=2,m6=3,cS=4,Ep=0,h6=1,vp=2,Lm=12800;function g6(y){return c... L195: `));if(!A)return null;be=Me(A,!0)}return be.shift()},"FS_stdin_getChar"),Re={ttys:[],init(){},shutdown(){},register(A,L){Re.ttys[A]={input:[],output:[],ops:L},j.registerDevice(A,Re... L196: `)){let n=r.trim();if(n.startsWith(`${t} `)||n.startsWith(`${t} `))return n.slice(t.length).trim()}return""}function gVe(e){let t=e.match(/^loc

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server/WebServer.mjsView on unpkg · L180

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L2: var iAe=Object.create;var N6=Object.defineProperty;var aAe=Object.getOwnPropertyDescriptor;var oAe=Object.getOwnPropertyNames;var sAe=Object.getPrototypeOf,lAe=Object.prototype.has... L3: `)}function Xr(...e){let t=k6(2,"info");process.stderr.write(` L4: ${t.link} ${P6(e)}`),M6("INFO ",e,t.short)}function Hr(...e){let t=k6(2,"warn");process.stderr.write(` ... L8: `+LY(t,i.offset,i.len))}return n.value}function LY(e,t,r=1){return`${e.replace(/(\t)|(\r)|(\n)/g,(n,i,o)=>i?"\u2409":o?"\u240D":"\u240A")} L9: ${"".padEnd(t)}${"^".repeat(r)}`}function $Y(e){return fRe(w7,e)}function wl(e){if(!e.type)throw new Error("This is not an AST node.");switch(e.type){case"universal":return H6(e.na... L10: `.repea

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjs

app/assets/index.jsView file

947contains invisible/control Unicode U+200B (zero width space) ${g}`)).style(`margin-left`,u?`${+u}px`:null).style(`width`,p===void 0?null:`${+p}px`).style(`font-variant`,T4(o,`normal`)).call(O4,f).node()}var $3=new Map([[`symbol`,PMe],[`color`,t6],[`opacity`,IMe]]);function FMe(e,t,n={}){return(r,a)=>

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L947

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

server/kernel.pyView file

•path = server/kernel.py kind = build_helper sizeBytes = 10781 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/kernel.pyView on unpkg

server/objectexplorer-catalog.jarView file

•path = server/objectexplorer-catalog.jar kind = compressed_blob sizeBytes = 17063 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

server/objectexplorer-catalog.jarView on unpkg

•path = server/objectexplorer-catalog.jar kind = nested_archive_needs_inspection sizeBytes = 17063 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

server/objectexplorer-catalog.jarView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.6.2 matchedPath = cli.js matchedIdentity = npm:[redacted]:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/Workbook.jsView file

•matchType = normalized_sha256 matchedPackage = @knockdata/objectexplorer@0.6.2 matchedPath = app/assets/Workbook.js matchedIdentity = npm:[redacted]:0.6.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/Workbook.jsView on unpkg

Source & flagged code

26 flagged · loading source

app/assets/WorkerParser.jsView file

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

app/assets/esm-worker.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/esm-worker.jsView on unpkg

1const e=`https://unpkg.com/@ffmpeg/core@0.12.9/dist/umd/ffmpeg-core.js`;var t;(function(e){e.LOAD=`LOAD`,e.EXEC=`EXEC`,e.FFPROBE=`FFPROBE`,e.WRITE_FILE=`WRITE_FILE`,e.READ_FILE=`RE...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

app/assets/esm-worker.jsView on unpkg · L1

server/WebServer.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server/WebServer.mjsView on unpkg · L180

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjs

app/assets/index.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L947

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

server/kernel.pyView file

•path = server/kernel.py kind = build_helper sizeBytes = 10781 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/kernel.pyView on unpkg

server/objectexplorer-catalog.jarView file

•path = server/objectexplorer-catalog.jar kind = compressed_blob sizeBytes = 17063 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

server/objectexplorer-catalog.jarView on unpkg

•path = server/objectexplorer-catalog.jar kind = nested_archive_needs_inspection sizeBytes = 17063 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

server/objectexplorer-catalog.jarView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/Workbook.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/Workbook.jsView on unpkg

Source & flagged code

26 flagged

app/assets/WorkerParser.jsView file

High

Child Process

Package source references child process execution.

app/assets/WorkerParser.jsView on unpkg · L51

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

app/assets/WorkerParser.jsView on unpkg

app/assets/esm-worker.jsView file

Lines 1-1javascript

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/esm-worker.jsView on unpkg

server/WebServer.mjsView file

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

server/WebServer.mjsView on unpkg · L180

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

server/WebServer.mjs

app/assets/index.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

app/assets/index.jsView on unpkg · L947

app/assets/lightgbmc.wasmView file

•path = app/assets/lightgbmc.wasm kind = wasm_module sizeBytes = 21264 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

app/assets/lightgbmc.wasmView on unpkg

server/kernel.pyView file

•path = server/kernel.py kind = build_helper sizeBytes = 10781 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

server/kernel.pyView on unpkg

server/objectexplorer-catalog.jarView file

•path = server/objectexplorer-catalog.jar kind = compressed_blob sizeBytes = 17063 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

server/objectexplorer-catalog.jarView on unpkg

•path = server/objectexplorer-catalog.jar kind = nested_archive_needs_inspection sizeBytes = 17063 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

server/objectexplorer-catalog.jarView on unpkg

demo/nl_train_stations.orcView file

•path = demo/nl_train_stations.orc kind = high_entropy_blob sizeBytes = 27653 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

demo/nl_train_stations.orcView on unpkg

cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli.jsView on unpkg

app/assets/Workbook.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

app/assets/Workbook.jsView on unpkg

@knockdata/objectexplorer@0.7.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code