@mutmutco/cli@4.3.41: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@mutmutco/cli@4.3.41: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/main.cjsView file

53* Constructs the CommanderError class L54: * @param {number} exitCode suggested exit code which could be used with process.exit L55: * @param {string} code an id string representing the error ... L201: var import_node_events = require("node:events"); L202: var import_node_child_process = __toESM(require("node:child_process"), 1); L203: var import_node_path = __toESM(require("node:path"), 1); ... L1222: this._outputConfiguration = { L1223: writeOut: (str) => import_node_process.default.stdout.write(str), L1224: writeErr: (str) => import_node_process.default.stderr.write(str), ... L1264: * @returns {Command[]} L1265: * @private L1266: */

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/main.cjsView on unpkg · L53

201var import_node_events = require("node:events"); L202: var import_node_child_process = __toESM(require("node:child_process"), 1); L203: var import_node_path = __toESM(require("node:path"), 1);

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L201

3526// src/cli-shared.ts L3527: var import_node_child_process2 = require("node:child_process"); L3528: var import_node_fs5 = require("node:fs"); ... L3531: // src/hub-url.ts L3532: var DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com"; L3533: function defaultHubUrl() { L3534: return process.env.MMI_HUB_URL || DEFAULT_HUB_URL; L3535: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.cjsView on unpkg · L3526

•matchType = normalized_sha256 matchedPackage = @mutmutco/cli@4.3.40 matchedPath = dist/main.cjs matchedIdentity = npm:QG11dG11dGNvL2NsaQ:4.3.40 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/main.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1837d210bc699bb4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @mutmutco/cli@4.3.40 matchedPath = dist/main.cjs matchedIdentity = npm:QG11dG11dGNvL2NsaQ:4.3.40 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/main.cjsView on unpkg

dist/index.cjsView file

4// src/client-version.ts L5: var import_node_fs = require("node:fs"); L6: var import_node_path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView on unpkg · L4

Source & flagged code

6 flagged

dist/main.cjsView file

53* Constructs the CommanderError class L54: * @param {number} exitCode suggested exit code which could be used with process.exit L55: * @param {string} code an id string representing the error ... L201: var import_node_events = require("node:events"); L202: var import_node_child_process = __toESM(require("node:child_process"), 1); L203: var import_node_path = __toESM(require("node:path"), 1); ... L1222: this._outputConfiguration = { L1223: writeOut: (str) => import_node_process.default.stdout.write(str), L1224: writeErr: (str) => import_node_process.default.stderr.write(str), ... L1264: * @returns {Command[]} L1265: * @private L1266: */

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/main.cjsView on unpkg · L53

201var import_node_events = require("node:events"); L202: var import_node_child_process = __toESM(require("node:child_process"), 1); L203: var import_node_path = __toESM(require("node:path"), 1);

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L201

3526// src/cli-shared.ts L3527: var import_node_child_process2 = require("node:child_process"); L3528: var import_node_fs5 = require("node:fs"); ... L3531: // src/hub-url.ts L3532: var DEFAULT_HUB_URL = "https://tqxxwzftic.execute-api.eu-central-1.amazonaws.com"; L3533: function defaultHubUrl() { L3534: return process.env.MMI_HUB_URL || DEFAULT_HUB_URL; L3535: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.cjsView on unpkg · L3526

•matchType = normalized_sha256 matchedPackage = @mutmutco/cli@4.3.40 matchedPath = dist/main.cjs matchedIdentity = npm:QG11dG11dGNvL2NsaQ:4.3.40 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/main.cjsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 1837d210bc699bb4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @mutmutco/cli@4.3.40 matchedPath = dist/main.cjs matchedIdentity = npm:QG11dG11dGNvL2NsaQ:4.3.40 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/main.cjsView on unpkg

dist/index.cjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2"use strict";

3

4// src/client-version.ts

5var import_node_fs = require("node:fs");

6var import_node_path = require("node:path");