@myassis/gateway@1.0.49: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@myassis/gateway@1.0.49: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/.envView file

•patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg

dist/services/tools/exec.jsView file

6exports.execTool = exports.cleanupExpiredApprovals = exports.getAndRemovePendingApproval = exports.addPendingApproval = exports.clearSessionCwd = exports.setSessionCwd = exports.ge... L7: const child_process_1 = require("child_process"); L8: const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/services/tools/exec.jsView on unpkg · L6

dist/services/ServiceManager.jsView file

5Cross-file remote execution chain: dist/services/ServiceManager.js spawns dist/config/index.js; helper contains network access plus dynamic code execution. L5: Object.defineProperty(exports, "__esModule", { value: true }); L6: exports.execAsUser = exports.isHelperReady = exports.stopHelper = exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startServ... L7: const child_process_1 = require("child_process"); ... L10: const fs_1 = __importDefault(require("fs")); L11: const axios_1 = __importDefault(require("axios")); L12: const shared_1 = require("@myassis/shared"); ... L26: // npm install -g 后，用当前模块位置定位包目录 L27: const pkgRoot = path_1.default.resolve(__dirname, '..', '..'); L28: return path_1.default.join(pkgRoot, 'dist', 'index.js'); ...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/services/ServiceManager.jsView on unpkg · L5

5Object.defineProperty(exports, "__esModule", { value: true }); L6: exports.execAsUser = exports.isHelperReady = exports.stopHelper = exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startServ... L7: const child_process_1 = require("child_process"); ... L10: const fs_1 = __importDefault(require("fs")); L11: const axios_1 = __importDefault(require("axios")); L12: const shared_1 = require("@myassis/shared"); ... L26: // npm install -g 后，用当前模块位置定位包目录 L27: const pkgRoot = path_1.default.resolve(__dirname, '..', '..'); L28: return path_1.default.join(pkgRoot, 'dist', 'index.js'); ... L202: // 因此这里把 powershell.exe 的完整调用串（含执行策略与隐藏窗口参数）作为 value 写入。 L203: const powershellExe = path_1.default.join(process.env.SystemRoot || 'C:\\Windows', 'Sy

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/ServiceManager.jsView on unpkg · L5

Source & flagged code

4 flagged

dist/.envView file

•patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg

dist/services/tools/exec.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.execTool = exports.cleanupExpiredApprovals = exports.getAndRemovePendingApproval = exports.addPendingApproval = exports.clearSessionCwd = exports.setSessionCwd = exports.getSessionCwd = void 0;

7const child_process_1 = require("child_process");

8const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/services/tools/exec.jsView on unpkg · L6

9const path_1 = __importDefault(require("path"));

10const os_1 = __importDefault(require("os"));

11const shared_1 = require("@myassis/shared");

12const crypto_1 = __importDefault(require("crypto"));

13const logger = (0, shared_1.getLogger)('exec');

14const execAsync = (0, util_1.promisify)(child_process_1.exec);

15// 待批准的命令缓存：token -> { command, cwd, timeout, sessionId, expiresAt }

16const pendingApprovals = new Map();

17// 会话级工作目录状态：sessionId -> cwd

18// 让 cd 命令能跨多次 exec 调用持久化工作目录

19const sessionCwdMap = new Map();

20/** 解析 cd 参数，返回目标绝对路径。支持 ~、相对路径、绝对路径 */

21function resolveCdTarget(cdArg, currentCwd) {

22 const arg = cdArg.trim();

23 if (!arg)

24 return os_1.default.homedir(); // cd 无参数 → 回家目录

25 if (arg === '~' || arg.startsWith('~/')) {

26 return path_1.default.join(os_1.default.homedir(), arg.slice(1));

dist/services/ServiceManager.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :