@maincode-ai/matilda-code@0.18.5: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@maincode-ai/matilda-code@0.18.5: Suspicious npm security report | LPM Firewall

Source & flagged code

12 flagged · loading source

chunks/tree-sitter-bash-BLXGIROC.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-BLXGIROC.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-BLXGIROC.js

chunks/tree-sitter-bash-BLXGIROC.jsView on unpkg · L8

chunks/chunk-63TK2VFY.jsView file

32init_esbuild_shims(); L33: import { execFile, spawn } from "node:child_process"; L34: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

chunks/chunk-63TK2VFY.jsView on unpkg · L32

134case "win32": L135: command = "powershell.exe"; L136: args = [

High

Shell

Package source references shell execution.

chunks/chunk-63TK2VFY.jsView on unpkg · L134

chunks/chunk-QLCMNU2S.jsView file

15L16: // packages/core/node_modules/undici/lib/core/symbols.js L17: var require_symbols = __commonJS({ ... L41: kBodyUsed: Symbol("used"), L42: kBody: Symbol("abstracted request body"), L43: kRunning: Symbol("running"), ... L649: } L650: const code = this.code = key.charCodeAt(index); L651: if (code > 127) { ... L2125: * @type {-2|-1|0|1} L2126: * @private L2127: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunks/chunk-QLCMNU2S.jsView on unpkg · L15

chunks/chunk-VJS7V6DQ.jsView file

•context = ath, data) {\n const line = `${JSON.stringify(data)}\n`;\n const dir = path3.dirname(filePath);\n if (!fs4.existsSync(dir)) {\n fs4.mkdirSync(dir, { recursive: true });\n }\n fs4.appendFileSync(filePath, Buffer.from(line, "utf8"), { flush: true });\n}\n__name(writeLineSync, "writeLineSync");\nfunction write(filePath, data) {\n const lines = data.map((item) => JSON.stringify(item)).join("\n");\n const dir = path3.dirname(filePath);\n if (!fs4.existsSync(dir)) {\n fs4.mkdirSync(dir, { recursive: true });\n }\n atomicWriteFileSync(filePath, `${lines}\n`, { encoding: "utf8" });\n}\n__name(write, "write");\nasync function countLines(filePath) {\n let fileStream;\n let rl;\n try {\n fileStream = fs4.createReadStream(filePath);\n rl = readline.createInterface({\

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

chunks/chunk-VJS7V6DQ.jsView on unpkg

•path = chunks/chunk-VJS7V6DQ.js kind = oversized_source_file sizeBytes = 5033892 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-VJS7V6DQ.jsView on unpkg

chunks/serve-ZGDKV4GH.jsView file

71Cross-file remote execution chain: chunks/serve-ZGDKV4GH.js spawns chunks/chunk-XWRL7PLE.js; helper contains network access plus dynamic code execution. L71: SUPPORTED_LANGUAGES, L72: writeStderrLine, L73: writeStdoutLine ... L162: import { L163: import_websocket_server L164: } from "./chunk-MKZ2UDTK.js"; ... L219: module.exports = depd; L220: var basePath = process.cwd(); L221: function containsNamespace(str, namespace) { ... L298: } L299: var str = process.env.NO_DEPRECATION || ""; L300: return containsNamespace(str, namespace);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/serve-ZGDKV4GH.jsView on unpkg · L71

71Detached bundled service listener: chunks/serve-ZGDKV4GH.js launches a Node helper and exposes a broad-bound HTTP listener. L71: SUPPORTED_LANGUAGES, L72: writeStderrLine, L73: writeStdoutLine ... L162: import { L163: import_websocket_server L164: } from "./chunk-MKZ2UDTK.js"; ... L219: module.exports = depd; L220: var basePath = process.cwd(); L221: function containsNamespace(str, namespace) { ... L298: } L299: var str = process.env.NO_DEPRECATION || ""; L300: return containsNamespace(str, namespace);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

chunks/serve-ZGDKV4GH.jsView on unpkg · L71

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 5982733 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg

Source & flagged code

12 flagged

chunks/tree-sitter-bash-BLXGIROC.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

chunks/tree-sitter-bash-BLXGIROC.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in chunks/tree-sitter-bash-BLXGIROC.js

chunks/tree-sitter-bash-BLXGIROC.jsView on unpkg · L8

chunks/chunk-63TK2VFY.jsView file

Lines 12-52javascript

12import {

13 Storage,

14 createDebugLogger

15} from "./chunk-BABNLMRP.js";

16import {

17 init_esbuild_shims

18} from "./chunk-ZFHZ5NNJ.js";

19import {

20 __name

21} from "./chunk-J2S4EL5Y.js";

22

23// packages/core/src/matilda/matildaOAuth2.ts

24init_esbuild_shims();

25import crypto from "crypto";

26import path2 from "node:path";

27import { promises as fs2 } from "node:fs";

28import { EventEmitter } from "events";

29import { randomUUID as randomUUID2 } from "node:crypto";

30

31// packages/core/src/utils/secure-browser-launcher.ts

32init_esbuild_shims();

33import { execFile, spawn } from "node:child_process";

34import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

chunks/chunk-63TK2VFY.jsView on unpkg · L32

35import { platform } from "node:os";

36import { resolve } from "node:path";

37import { URL, fileURLToPath } from "node:url";

38

39// packages/core/src/utils/browser.ts

40init_esbuild_shims();

41var browserBlocklist = ["www-browser"];

42function isBrowserCommandBlocked(command) {

43 const commandName = command.replace(/\\/g, "/").split("/").pop();

44 return !!commandName && browserBlocklist.includes(commandName);

45}

46__name(isBrowserCommandBlocked, "isBrowserCommandBlocked");

47function shouldAttemptBrowserLaunch(options = {}) {

48 const browserEnv = process.env["BROWSER"]?.trim();

49 const browserCommand = browserEnv?.match(/^\S+/)?.[0];

50 if (!options.ignoreBrowserBlocklist && process.platform !== "win32" && browserCommand && isBrowserCommandBlocked(browserCommand)) {

51 return false;

52 }

Lines 114-154javascript

114 } catch (_error) {

115 console.warn(

116 `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(

117 _error

118 )}. Falling back to the platform browser opener.`

119 );

120 }

121 }

chunks/chunk-QLCMNU2S.jsView file

15L16: // packages/core/node_modules/undici/lib/core/symbols.js L17: var require_symbols = __commonJS({ ... L41: kBodyUsed: Symbol("used"), L42: kBody: Symbol("abstracted request body"), L43: kRunning: Symbol("running"), ... L649: } L650: const code = this.code = key.charCodeAt(index); L651: if (code > 127) { ... L2125: * @type {-2|-1|0|1} L2126: * @private L2127: */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunks/chunk-QLCMNU2S.jsView on unpkg · L15

chunks/chunk-VJS7V6DQ.jsView file

•context = ath, data) {\n const line = `${JSON.stringify(data)}\n`;\n const dir = path3.dirname(filePath);\n if (!fs4.existsSync(dir)) {\n fs4.mkdirSync(dir, { recursive: true });\n }\n fs4.appendFileSync(filePath, Buffer.from(line, "utf8"), { flush: true });\n}\n__name(writeLineSync, "writeLineSync");\nfunction write(filePath, data) {\n const lines = data.map((item) => JSON.stringify(item)).join("\n");\n const dir = path3.dirname(filePath);\n if (!fs4.existsSync(dir)) {\n fs4.mkdirSync(dir, { recursive: true });\n }\n atomicWriteFileSync(filePath, `${lines}\n`, { encoding: "utf8" });\n}\n__name(write, "write");\nasync function countLines(filePath) {\n let fileStream;\n let rl;\n try {\n fileStream = fs4.createReadStream(filePath);\n rl = readline.createInterface({\

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

chunks/chunk-VJS7V6DQ.jsView on unpkg

•path = chunks/chunk-VJS7V6DQ.js kind = oversized_source_file sizeBytes = 5033892 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

chunks/chunk-VJS7V6DQ.jsView on unpkg

chunks/serve-ZGDKV4GH.jsView file

71Cross-file remote execution chain: chunks/serve-ZGDKV4GH.js spawns chunks/chunk-XWRL7PLE.js; helper contains network access plus dynamic code execution. L71: SUPPORTED_LANGUAGES, L72: writeStderrLine, L73: writeStdoutLine ... L162: import { L163: import_websocket_server L164: } from "./chunk-MKZ2UDTK.js"; ... L219: module.exports = depd; L220: var basePath = process.cwd(); L221: function containsNamespace(str, namespace) { ... L298: } L299: var str = process.env.NO_DEPRECATION || ""; L300: return containsNamespace(str, namespace);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

chunks/serve-ZGDKV4GH.jsView on unpkg · L71

71Detached bundled service listener: chunks/serve-ZGDKV4GH.js launches a Node helper and exposes a broad-bound HTTP listener. L71: SUPPORTED_LANGUAGES, L72: writeStderrLine, L73: writeStdoutLine ... L162: import { L163: import_websocket_server L164: } from "./chunk-MKZ2UDTK.js"; ... L219: module.exports = depd; L220: var basePath = process.cwd(); L221: function containsNamespace(str, namespace) { ... L298: } L299: var str = process.env.NO_DEPRECATION || ""; L300: return containsNamespace(str, namespace);

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

chunks/serve-ZGDKV4GH.jsView on unpkg · L71

vendor/ripgrep/x64-darwin/rgView file

•path = vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

vendor/ripgrep/x64-darwin/rgView on unpkg

vendor/tree-sitter/tree-sitter.wasmView file

•path = vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

vendor/tree-sitter/tree-sitter.wasmView on unpkg

cli.jsView file

•path = cli.js kind = oversized_cli_entrypoint sizeBytes = 5982733 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

cli.jsView on unpkg