@kurumera/cli@0.14.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@kurumera/cli@0.14.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

17 flagged · loading source

dist/util/keychain.jsView file

1import { execFileSync } from "node:child_process"; L2: /**

High

Child Process

Package source references child process execution.

dist/util/keychain.jsView on unpkg · L1

4* platform — macOS Keychain (`security`), Windows Credential Manager L5: * (PowerShell `CredentialManager` cmdlets, falling back to `cmdkey` for L6: * read-back availability checks), Linux Secret Service (`secret-tool`).

High

Shell

Package source references shell execution.

dist/util/keychain.jsView on unpkg · L4

dist/commands/preview.jsView file

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/preview.jsView on unpkg · L1

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { L6: try { L7: if (process.platform === "win32") { L8: spawn("cmd", ["/c", "start", "", url.replace(/&/g, "^&")], { stdio: "ignore", detached: true, windowsVerbatimArguments: true }).unref(); ... L26: const authToken = await resolveAuthToken(); L27: process.stdout.write("Waiting for the build"); L28: let previewUrl = ""; ... L35: const r = await fetch(`${PUSH_URL}/status?store=${encodeURIComponent(store)}`, { headers: authToken ? { Authorization: `Bearer ${authToken}` } : {} });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/preview.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/preview.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/preview.jsView on unpkg

dist/commands/preview.js#virtual:normalized:round1View file

1import { spawn } from "node:child_process"; L2: import { readConfig } from "../util/config.js"; L3: import { resolveAuthToken } from "../util/resolveAuthToken.js"; L4: const PUSH_URL = (process.env.KURUMERA_PUSH_URL || "https://themekit.kurumera.com/_push").replace(/\/+$/, ""); L5: function openBrowser(url) { ... L15: /** L16: * `kurumera theme preview` — poll the latest pushed build; when it"s ready, open\n * the preview URL (the theme rendered against a live store, unpublished).\n */\nexport async func... L17: if (s.status === "idle" || !s.status) {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/commands/preview.js#virtual:normalized:round1View on unpkg · L1

dist/commands/dev.jsView file

38Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin.js -> dist/commands/dev.js L38: } L39: const tar = spawnSync("tar", ["-czf", "-", "--exclude=node_modules", "--exclude=.next", "--exclude=.git", "--exclude=dist", "."], { cwd: dir, maxBuffer: 100 * 1024 * 1024 }); L40: if (tar.status !== 0 || !tar.stdout || !tar.stdout.length) L41: return; // silent — a checkpoint miss isn't fatal, there'll be another in a few minutes ... L45: try { L46: const res = await fetch(`${PUSH_URL}/checkpoint`, { L47: method: "POST", L48: headers: { Authorization: `Bearer ${authToken}`, "Content-Type": "application/gzip", "X-Kurumera-Store": store }, L49: body: tar.stdout, L50: });

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/commands/dev.jsView on unpkg · L38

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/dev.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/dev.jsView on unpkg

dist/commands/dev.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/dev.js#virtual:normalized:round1View on unpkg

dist/commands/checkpoint.jsView file

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/checkpoint.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/checkpoint.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 4b763aba98fdc158 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/checkpoint.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 shingleOverlap = 33 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/commands/checkpoint.jsView on unpkg

dist/commands/login.jsView file

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/login.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/login.jsView on unpkg

dist/commands/marketplace.jsView file

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/marketplace.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/marketplace.jsView on unpkg

dist/commands/pull.jsView file

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/pull.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/pull.jsView on unpkg

dist/commands/push.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kurumera/cli@0.9.1 matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.9.1 similarity = 0.879 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/push.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/commands/push.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/push.jsView on unpkg

dist/lib/themeCheck.jsView file

•matchType = normalized_sha256 matchedPackage = @kurumera/cli@0.13.0 matchedPath = dist/lib/themeCheck.js matchedIdentity = npm:QGt1cnVtZXJhL2NsaQ:0.13.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/lib/themeCheck.jsView on unpkg