@lotics/cli: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

8 flagged

dist/src/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @lotics/cli@0.86.2 matchedIdentity = npm:QGxvdGljcy9jbGk:0.86.2 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

30640import path5 from "node:path"; L30641: import { spawn as spawn2 } from "node:child_process"; L30642: import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/src/cli.jsView on unpkg · L30640

47060execute() { L47061: for (const cmd of commands) cmd.execute(); L47062: },

High

Shell

Package source references shell execution.

dist/src/cli.jsView on unpkg · L47060

31971const vitePort = await pickPort(args.vitePort ?? DEFAULT_VITE_PORT, wrapperPort); L31972: const viteUrl = `http://localhost:${vitePort}/`; L31973: const html = buildWrapperPage({ ... L31979: }); L31980: const viteChild = spawn( L31981: "npx", ... L31985: stdio: [process.stdin.isTTY ? "inherit" : "ignore", "inherit", "inherit"], L31986: env: ipv4ChildEnv({ ...process.env, FORCE_COLOR: "1" }) L31987: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/cli.jsView on unpkg · L31971

400modulo = (dividend - 1) % 26; L401: name = String.fromCharCode("A".charCodeAt(0) + modulo) + name; L402: dividend = Math.floor((dividend - modulo) / 26); ... L716: else if (v >= base1904) epoch += 24 * 60 * 60 * 1e3; L717: return (epoch - (dnthresh + (v.getTimezoneOffset() - basedate.getTimezoneOffset()) * 6e4)) / (24 * 60 * 60 * 1e3); L718: } ... L1910: } catch (e) { L1911: throw Error(`Error in https://github.com/jojoee/bahttext L1912: ${e.toString()}`); ... L10240: return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/cli.jsView on unpkg · L400

17877function genUmdModule(options) { L17878: return "\n(function (root, factory) {\n if (typeof define === 'function' && define.amd) {\n // AMD. Register as an anonymous module.\n define(['chevrotain'], facto... L17879: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli.jsView on unpkg · L17877

10240return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli.jsView on unpkg · L10240

dist/render_page.jsView file

•path = dist/render_page.js kind = oversized_source_file sizeBytes = 2298342 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/render_page.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/src/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

30640import path5 from "node:path"; L30641: import { spawn as spawn2 } from "node:child_process"; L30642: import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/src/cli.jsView on unpkg · L30640

47060execute() { L47061: for (const cmd of commands) cmd.execute(); L47062: },

High

Shell

Package source references shell execution.

dist/src/cli.jsView on unpkg · L47060

@lotics/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged

dist/src/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/cli.jsView on unpkg

30640import path5 from "node:path"; L30641: import { spawn as spawn2 } from "node:child_process"; L30642: import { tmpdir } from "node:os";

High

Child Process

Package source references child process execution.

dist/src/cli.jsView on unpkg · L30640

47060execute() { L47061: for (const cmd of commands) cmd.execute(); L47062: },

High

Shell

Package source references shell execution.

dist/src/cli.jsView on unpkg · L47060

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/cli.jsView on unpkg · L31971

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/src/cli.jsView on unpkg · L400

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/src/cli.jsView on unpkg · L17877

10240return toBecomeFast; L10241: eval(toBecomeFast); L10242: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/src/cli.jsView on unpkg · L10240

dist/render_page.jsView file

•path = dist/render_page.js kind = oversized_source_file sizeBytes = 2298342 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/render_page.jsView on unpkg

@lotics/cli@0.90.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code