@mindexec/cli@0.2.475: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@mindexec/cli@0.2.475: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

server.jsView file

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L12

30L31: const execAsync = promisify(exec); L32: const execFileAsync = promisify(execFile);

High

Shell

Package source references shell execution.

server.jsView on unpkg · L30

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. server.js: import { promises as fs, readFileSync, statSync, createReadStream, chmodSync, mkdirSync, writeFileSync } from 'fs'; writeFileSync(identityPath, `${JSON.stringify(next, null, 2)}\n`, { await writeFileAtomically(fullPath, content, 'utf8'); await fs.copyFile(srcPath, dstPath); await writeFileAtomically(migrationMarkerPath, JSON.stringify(report, null, 2), 'utf8'); overwriteFiles: ['_metadata.json'] overwriteFiles: [] overwriteFiles: []

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

server.jsView on unpkg

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util'; ... L18: import sharp from 'sharp'; L19: import { createServer } from 'http'; L20: import { WebSocket, WebSocketServer } from 'ws'; ... L36: const app = express(); L37: const PORT = normalizePort(process.env.BRIDGE_PORT); L38: const BRIDGE_ROOT = path.dirname(fileURLToPath(import.meta.url)); L39: const PACKAGE_INFO = JSON.parse(readFileSync(path.join(BRIDGE_ROOT, 'package.json'), 'utf8').replace(/^\uFEFF/, '')); L40: const BRIDGE_PACKAGE_NAME = String(PACKAGE_INFO.name || '@mindexec/cli'); ... L50: const VERBOSE_REMOTE_AGENT_LOGS = /^(1|true|yes|on)$/i.test(String(process.env.MINDEXEC_VERBOSE_REMOTE_AGENT || process.env.BRIDGE_VERBOSE_REMOTE_AGENT || '

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

server.jsView on unpkg · L12

12Cross-file remote execution chain: server.js spawns wwwroot/_framework/blazor.webassembly.js; helper contains network access plus dynamic code execution. L12: import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util'; ... L18: import sharp from 'sharp'; L19: import { createServer } from 'http'; L20: import { WebSocket, WebSocketServer } from 'ws'; ... L36: const app = express(); L37: const PORT = normalizePort(process.env.BRIDGE_PORT); L38: const BRIDGE_ROOT = path.dirname(fileURLToPath(import.meta.url)); L39: const PACKAGE_INFO = JSON.parse(readFileSync(path.join(BRIDGE_ROOT, 'package.json'), 'utf8').replace(/^\uFEFF/, '')); L40: const BRIDGE_PACKAGE_NAME = String(PACKAGE_INFO.name || '@mindexec/cli'); ... L50: co

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server.jsView on unpkg · L12

wwwroot/_framework/dotnet.runtime.opaiwunc3t.jsView file

2//! The .NET Foundation licenses this file to you under the MIT license. L3: var e="9.0.17",t="Release",n=!1;const r=[[!0,"mono_wasm_register_root","number",["number","number","string"]],[!0,"mono_wasm_deregister_root",null,["number"]],[!0,"mono_wasm_string... L4: //# sourceMappingURL=dotnet.runtime.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

wwwroot/_framework/dotnet.runtime.opaiwunc3t.jsView on unpkg · L2

wwwroot/_framework/dotnet.native.566r55w3xu.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});if(_nativeMod... L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wwwroot/_framework/dotnet.native.566r55w3xu.jsView on unpkg · L7

scripts/remote-fleet-render-smoke.mjsView file

9L10: const SYNTHETIC_COUNT = Number(process.env.REMOTE_FLEET_RENDER_SMOKE_COUNT || 500); L11: ... L436: async function loadCss3DManager() { L437: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L438: const hotPathModulePath = path.resolve(__dirname, '../../MindExecution.Shared/wwwroot/js/mind-map-css3d-hotpath.js'); ... L447: const runtimeTrace = []; L448: const webSocketConnections = []; L449: const webSocketSends = []; ... L519: Blob, L520: TextDecoder, L521: TextEncoder,

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

scripts/remote-fleet-render-smoke.mjsView on unpkg · L9

remote-hub.jsView file

1import net from 'net'; L2: import os from 'os'; ... L9: const MAX_LINE_CHARS = 4 * 1024 * 1024; L10: const MAX_THUMBNAIL_BASE64_CHARS = 3 * 1024 * 1024; L11: const MAX_STREAM_BASE64_CHARS = 3 * 1024 * 1024; ... L140: const DUPLICATE_DEVICE_RETRY_AFTER_MS = 30000; L141: const SYNTHETIC_FRAME_DATA_URL = 'data:image/png;base64,[redacted]'; L142: const SYNTHETIC_FRAME_PAYLOAD = Buffer.from(SYNTHETIC_FRAME_DATA_URL.split(',')[1], 'base64'); ... L322: L323: function isPrivateIPv4(value) { L324: const parts = String(value || '').split('.').map(part => Number(part)); ... L397: const candidates = [];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

remote-hub.jsView on unpkg · L1

scripts/remote-fast-mdm-browser-smoke.mjsView file

3import assert from 'node:assert/strict'; L4: import { spawn } from 'node:child_process'; L5: import { mkdtemp, rm } from 'node:fs/promises'; L6: import net from 'node:net'; L7: import os from 'node:os'; ... L14: const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); L15: const REQUESTED_FPS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_REQUEST_FPS || 12); L16: const SAMPLE_MS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_SAMPLE_MS || 1500);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/remote-fast-mdm-browser-smoke.mjsView on unpkg · L3

3Detached bundled service listener: scripts/remote-fast-mdm-browser-smoke.mjs spawns server.js; helper exposes a broad-bound HTTP listener. L3: import assert from 'node:assert/strict'; L4: import { spawn } from 'node:child_process'; L5: import { mkdtemp, rm } from 'node:fs/promises'; L6: import net from 'node:net'; L7: import os from 'node:os'; ... L14: const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); L15: const REQUESTED_FPS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_REQUEST_FPS || 12); L16: const SAMPLE_MS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_SAMPLE_MS || 1500); ... L45: L46: const payload = await response.json().catch(() => null); L47: return { status: response.status, ok: response.ok, payload }; ... L91:

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

scripts/remote-fast-mdm-browser-smoke.mjsView on unpkg · L3

wwwroot/_framework/Microsoft.AspNetCore.Authorization.htf46vkphd.dllView file

•path = wwwroot/_framework/Microsoft.AspNetCore.Authorization.htf46vkphd.dll kind = native_binary sizeBytes = 26624 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

wwwroot/_framework/Microsoft.AspNetCore.Authorization.htf46vkphd.dllView on unpkg

wwwroot/_framework/dotnet.native.x6q5aixc38.wasmView file

•path = wwwroot/_framework/dotnet.native.x6q5aixc38.wasm kind = wasm_module sizeBytes = 3701624 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wwwroot/_framework/dotnet.native.x6q5aixc38.wasmView on unpkg

start-bridge.batView file

•path = start-bridge.bat kind = build_helper sizeBytes = 558 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start-bridge.batView on unpkg

codex-runtime.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

codex-runtime.jsView on unpkg

wwwroot/_content/MindExecution.Shared/js/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = @jacebenson/jsn@3.3.1 matchedPath = [redacted].min.js matchedIdentity = npm:QGphY2ViZW5zb24vanNu:3.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wwwroot/_content/MindExecution.Shared/js/marked.min.jsView on unpkg