@mindexec/cli@0.2.478: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@mindexec/cli@0.2.478: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

16 flagged · loading source

server.jsView file

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L12

30L31: const execAsync = promisify(exec); L32: const execFileAsync = promisify(execFile);

High

Shell

Package source references shell execution.

server.jsView on unpkg · L30

12import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util'; ... L18: import sharp from 'sharp'; L19: import { createServer } from 'http'; L20: import { WebSocket, WebSocketServer } from 'ws'; ... L36: const app = express(); L37: const PORT = normalizePort(process.env.BRIDGE_PORT); L38: const BRIDGE_ROOT = path.dirname(fileURLToPath(import.meta.url)); L39: const PACKAGE_INFO = JSON.parse(readFileSync(path.join(BRIDGE_ROOT, 'package.json'), 'utf8').replace(/^\uFEFF/, '')); L40: const BRIDGE_PACKAGE_NAME = String(PACKAGE_INFO.name || '@mindexec/cli'); ... L50: const VERBOSE_REMOTE_AGENT_LOGS = /^(1|true|yes|on)$/i.test(String(process.env.MINDEXEC_VERBOSE_REMOTE_AGENT || process.env.BRIDGE_VERBOSE_REMOTE_AGENT || '

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

server.jsView on unpkg · L12

12Cross-file remote execution chain: server.js spawns wwwroot/_framework/blazor.webassembly.js; helper contains network access plus dynamic code execution. L12: import path from 'path'; L13: import { exec, spawn, spawnSync, execFile } from 'child_process'; L14: import { promisify } from 'util'; ... L18: import sharp from 'sharp'; L19: import { createServer } from 'http'; L20: import { WebSocket, WebSocketServer } from 'ws'; ... L36: const app = express(); L37: const PORT = normalizePort(process.env.BRIDGE_PORT); L38: const BRIDGE_ROOT = path.dirname(fileURLToPath(import.meta.url)); L39: const PACKAGE_INFO = JSON.parse(readFileSync(path.join(BRIDGE_ROOT, 'package.json'), 'utf8').replace(/^\uFEFF/, '')); L40: const BRIDGE_PACKAGE_NAME = String(PACKAGE_INFO.name || '@mindexec/cli'); ... L50: co

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

server.jsView on unpkg · L12

wwwroot/_framework/dotnet.runtime.opaiwunc3t.jsView file

2//! The .NET Foundation licenses this file to you under the MIT license. L3: var e="9.0.17",t="Release",n=!1;const r=[[!0,"mono_wasm_register_root","number",["number","number","string"]],[!0,"mono_wasm_deregister_root",null,["number"]],[!0,"mono_wasm_string... L4: //# sourceMappingURL=dotnet.runtime.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

wwwroot/_framework/dotnet.runtime.opaiwunc3t.jsView on unpkg · L2

wwwroot/_framework/dotnet.native.566r55w3xu.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;Module["ready"]=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});if(_nativeMod... L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

wwwroot/_framework/dotnet.native.566r55w3xu.jsView on unpkg · L7

scripts/remote-fleet-render-smoke.mjsView file

9L10: const SYNTHETIC_COUNT = Number(process.env.REMOTE_FLEET_RENDER_SMOKE_COUNT || 500); L11: ... L436: async function loadCss3DManager() { L437: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L438: const hotPathModulePath = path.resolve(__dirname, '../../MindExecution.Shared/wwwroot/js/mind-map-css3d-hotpath.js'); ... L447: const runtimeTrace = []; L448: const webSocketConnections = []; L449: const webSocketSends = []; ... L519: Blob, L520: TextDecoder, L521: TextEncoder,

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

scripts/remote-fleet-render-smoke.mjsView on unpkg · L9

remote-hub.jsView file

1import net from 'net'; L2: import os from 'os'; ... L9: const MAX_LINE_CHARS = 4 * 1024 * 1024; L10: const MAX_THUMBNAIL_BASE64_CHARS = 3 * 1024 * 1024; L11: const MAX_STREAM_BASE64_CHARS = 3 * 1024 * 1024; ... L140: const DUPLICATE_DEVICE_RETRY_AFTER_MS = 30000; L141: const SYNTHETIC_FRAME_DATA_URL = 'data:image/png;base64,[redacted]'; L142: const SYNTHETIC_FRAME_PAYLOAD = Buffer.from(SYNTHETIC_FRAME_DATA_URL.split(',')[1], 'base64'); ... L322: L323: function isPrivateIPv4(value) { L324: const parts = String(value || '').split('.').map(part => Number(part)); ... L397: const candidates = [];

Low

Weak Crypto

Package source references weak cryptographic algorithms.

remote-hub.jsView on unpkg · L1

scripts/remote-fast-mdm-browser-smoke.mjsView file

3import assert from 'node:assert/strict'; L4: import { spawn } from 'node:child_process'; L5: import { mkdtemp, rm } from 'node:fs/promises'; L6: import net from 'node:net'; L7: import os from 'node:os'; ... L14: const LOCAL_BRIDGE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'); L15: const REQUESTED_FPS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_REQUEST_FPS || 12); L16: const SAMPLE_MS = Number(process.env.MINDEXEC_REMOTE_MDM_BROWSER_SAMPLE_MS || 1500);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/remote-fast-mdm-browser-smoke.mjsView on unpkg · L3

electron/main.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mindexec/cli@0.2.521 matchedIdentity = npm:QG1pbmRleGVjL2NsaQ:0.2.521 similarity = 0.752 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.cjsView on unpkg

3Detached bundled service listener: electron/main.cjs spawns server.js; helper exposes a broad-bound HTTP listener. L3: const { app, BrowserWindow, dialog, ipcMain } = require('electron'); L4: const { spawn } = require('child_process'); L5: const fs = require('fs'); L6: const http = require('http'); L7: const net = require('net'); ... L27: let isQuitting = false; L28: let requestedExitCode = 0; L29: let activeBridgePort = DEFAULT_BRIDGE_PORT; ... L39: function resolveDesktopIconPath() { L40: const iconPath = path.resolve(__dirname, '..', 'wwwroot', 'icon-512.png'); L41: return fs.existsSync(iconPath) ? iconPath : undefined; ... L45: if (!app.isPackaged) return 'development';

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

electron/main.cjsView on unpkg · L3

wwwroot/_framework/MindExecution.Plugins.Business.7m8u1q142p.dllView file

•path = wwwroot/_framework/MindExecution.Plugins.Business.7m8u1q142p.dll kind = native_binary sizeBytes = 675328 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

wwwroot/_framework/MindExecution.Plugins.Business.7m8u1q142p.dllView on unpkg

wwwroot/_framework/dotnet.native.x6q5aixc38.wasmView file

•path = wwwroot/_framework/dotnet.native.x6q5aixc38.wasm kind = wasm_module sizeBytes = 3701624 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wwwroot/_framework/dotnet.native.x6q5aixc38.wasmView on unpkg

start-bridge.batView file

•path = start-bridge.bat kind = build_helper sizeBytes = 590 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

start-bridge.batView on unpkg

codex-runtime.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 7

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

codex-runtime.jsView on unpkg

wwwroot/_content/MindExecution.Shared/js/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = @jacebenson/jsn@3.3.1 matchedPath = [redacted].min.js matchedIdentity = npm:QGphY2ViZW5zb24vanNu:3.3.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

wwwroot/_content/MindExecution.Shared/js/marked.min.jsView on unpkg