Loading npm security reports…

@leju-gym/gym-cli@0.0.10: Suspicious npm security report (Warn) | LPM Firewall

registry / @leju-gym/gym-cli / 0.0.10

@leju-gym/gym-cli@0.0.10

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 201 KB of source, external domains: dev.lejugym.com, oss-cn-hangzhou.aliyuncs.com, test.lejugym.com, www.lejugym.com

Source & flagged code

4 flagged

bin/gym.jsView file

17const os = require("os"); L18: const { execSync } = require("child_process"); L19: const { pathToFileURL } = require("url");

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

14*/ L15: const fs = require("fs"); L16: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gym.jsView on unpkg · L14

dist/gym.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/gym.mjsView on unpkg · L1

1#!/usr/bin/env node L2: var Rs=Object.defineProperty;var Je=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,n)=>(typeof require<"u"?require:e)[n]}):t)(function(t){if(typeof require<"u"... L3: BAG \u5217\u8868:`));for(let g of l){let m=tt[g.status]||"\u672A\u77E5";console.log(`ID: ${g.id}`),console.log(`\u540D\u79F0: ${g.dataName||""}`),console.log(`\u8BBE\u5907: ${g.... ... L13: `,"utf-8")}catch{}}log(e){this.options.debug&&console.log(`[DataSync] ${e}`),this.callbacks.onProgress?.(e)}sleep(e){return new Promise(n=>setTimeout(n,e))}get totalRemainingBytes(... L14: \u2550\u2550\u2550 \u4E0B\u8F7D\u5B8C\u6210 \u2550\u2550\u2550`)),console.log(R.green(` \u6210\u529F: ${e.successCount}`)),e.failCount>0&&console.log(R.red(` \u5931\u8D25: ${e.fa... L15: `);ho(d,c,{encoding:"utf-8"}),wo("powershell.exe",["-NoProfile","-ExecutionPolicy","Bypass","-WindowStyle","Hidden","-File",d],{detached:!0,stdio:"ignore",windowsHide:!0}).unref()}...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/gym.mjsView on unpkg · L1

Source & flagged code

4 flagged · loading source

bin/gym.jsView file

17const os = require("os"); L18: const { execSync } = require("child_process"); L19: const { pathToFileURL } = require("url");

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

14*/ L15: const fs = require("fs"); L16: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gym.jsView on unpkg · L14

dist/gym.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Findings

4 High3 Medium5 Low

HighChild Processbin/gym.js

HighSame File Env Network Executiondist/gym.mjs

HighCommand Output Exfiltrationdist/gym.mjs

HighObfuscated

MediumDynamic Requirebin/gym.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/gym.jsView file

17const os = require("os"); L18: const { execSync } = require("child_process"); L19: const { pathToFileURL } = require("url");

High

Child Process

Package source references child process execution.

bin/gym.jsView on unpkg · L17

14*/ L15: const fs = require("fs"); L16: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gym.jsView on unpkg · L14

dist/gym.mjsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/gym.mjsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/gym.mjsView on unpkg · L1