@myassis/gateway@1.0.59: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@myassis/gateway@1.0.59: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/.envView file

•patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg

dist/services/tools/exec.jsView file

6exports.execTool = exports.cleanupExpiredApprovals = exports.getAndRemovePendingApproval = exports.addPendingApproval = exports.clearSessionCwd = exports.setSessionCwd = exports.ge... L7: const child_process_1 = require("child_process"); L8: const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/services/tools/exec.jsView on unpkg · L6

dist/services/ServiceManager.jsView file

5Cross-file remote execution chain: dist/services/ServiceManager.js spawns dist/config/index.js; helper contains network access plus dynamic code execution. L5: Object.defineProperty(exports, "__esModule", { value: true }); L6: exports.execAsUser = exports.isHelperReady = exports.stopHelper = exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startServ... L7: const child_process_1 = require("child_process"); ... L10: const fs_1 = __importDefault(require("fs")); L11: const axios_1 = __importDefault(require("axios")); L12: const shared_1 = require("@myassis/shared"); ... L26: // npm install -g 后，用当前模块位置定位包目录 L27: const pkgRoot = path_1.default.resolve(__dirname, '..', '..'); L28: return path_1.default.join(pkgRoot, 'dist', 'index.js'); ...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/services/ServiceManager.jsView on unpkg · L5

5Object.defineProperty(exports, "__esModule", { value: true }); L6: exports.execAsUser = exports.isHelperReady = exports.stopHelper = exports.updateService = exports.checkForUpdates = exports.restartService = exports.stopService = exports.startServ... L7: const child_process_1 = require("child_process"); ... L10: const fs_1 = __importDefault(require("fs")); L11: const axios_1 = __importDefault(require("axios")); L12: const shared_1 = require("@myassis/shared"); ... L26: // npm install -g 后，用当前模块位置定位包目录 L27: const pkgRoot = path_1.default.resolve(__dirname, '..', '..'); L28: return path_1.default.join(pkgRoot, 'dist', 'index.js'); ... L164: "$psi.WorkingDirectory = $workDir", L165: "# 关键：UseShellExecute=$true 走 ShellExecute API，子进程不继承父 PS 的 stdout/stderr/stdin 句柄", L166: "# 防止 PowerShell

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/ServiceManager.jsView on unpkg · L5

dist/services/tools/file.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @myassis/gateway@1.0.52 matchedIdentity = npm:QG15YXNzaXMvZ2F0ZXdheQ:1.0.52 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/tools/file.jsView on unpkg

Source & flagged code

5 flagged

dist/.envView file

•patternName = blocked_file severity = critical matchedText = dist/.env redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/.envView on unpkg

dist/services/tools/exec.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.execTool = exports.cleanupExpiredApprovals = exports.getAndRemovePendingApproval = exports.addPendingApproval = exports.clearSessionCwd = exports.setSessionCwd = exports.getSessionCwd = void 0;

7const child_process_1 = require("child_process");

8const util_1 = require("util");

High

Child Process

Package source references child process execution.

dist/services/tools/exec.jsView on unpkg · L6

9const shared_1 = require("@myassis/shared");

10const crypto_1 = __importDefault(require("crypto"));

11const logger = (0, shared_1.getLogger)('exec');

12const execAsync = (0, util_1.promisify)(child_process_1.exec);

13// 待批准的命令缓存：token -> { command, cwd, timeout, sessionId, expiresAt }

14const pendingApprovals = new Map();

15// 会话级工作目录状态：sessionId -> cwd

16// 让 cd 命令能跨多次 exec 调用持久化工作目录

17const sessionCwdMap = new Map();

18/** 获取某个 session 的当前工作目录 */

19function getSessionCwd(sessionId) {

20 return sessionCwdMap.get(sessionId);

21}

22exports.getSessionCwd = getSessionCwd;

23/** 设置某个 session 的工作目录 */

24function setSessionCwd(sessionId, cwd) {

25 sessionCwdMap.set(sessionId, cwd);

26}

dist/services/ServiceManager.jsView file

Lines 1-25javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod :

dist/services/tools/file.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @myassis/gateway@1.0.52 matchedIdentity = npm:QG15YXNzaXMvZ2F0ZXdheQ:1.0.52 similarity = 0.824 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/services/tools/file.jsView on unpkg