@nakirosai/nakiros: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@nakirosai/nakiros: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/ui/assets/livescript-BwQOo05w.jsView file

1var f=function(e,n){var g=n.next||"start";{n.next=n.next;var k=x[g];if(k.splice){for(var l=0;l<k.length;++l){var t=k[l];if(t.regex&&e.match(t.regex))return n.next=t.next||n.next,t....

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/assets/livescript-BwQOo05w.jsView on unpkg · L1

dist/bin/nakiros.jsView file

57}); L58: import { execSync } from "child_process"; L59: import { existsSync as existsSync85, mkdirSync as mkdirSync38, unlinkSync as unlinkSync10, writeFileSync as writeFileSync44 } from "fs"; ... L96: function guiTarget() { L97: return `gui/${process.getuid ? process.getuid() : process.env.UID ?? "501"}`; L98: } L99: function isServiceDisabled() { L100: const { ok, stdout } = launchctl(["print-disabled", guiTarget()]); L101: if (!ok) return false; ... L422: import Fastify from "fastify"; L423: import fastifyWebsocket from "@fastify/websocket"; L424: import fastifyStatic from "@fastify/static";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/nakiros.jsView on unpkg · L57

57}); L58: import { execSync } from "child_process"; L59: import { existsSync as existsSync85, mkdirSync as mkdirSync38, unlinkSync as unlinkSync10, writeFileSync as writeFileSync44 } from "fs"; ... L96: function guiTarget() { L97: return `gui/${process.getuid ? process.getuid() : process.env.UID ?? "501"}`; L98: } L99: function isServiceDisabled() { L100: const { ok, stdout } = launchctl(["print-disabled", guiTarget()]); L101: if (!ok) return false; ... L422: import Fastify from "fastify"; L423: import fastifyWebsocket from "@fastify/websocket"; L424: import fastifyStatic from "@fastify/static";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bin/nakiros.jsView on unpkg · L57

dist/ui/assets/geist-mono-cyrillic-500-normal-mNhfPmgl.woffView file

•path = dist/ui/assets/geist-mono-cyrillic-500-normal-mNhfPmgl.woff kind = high_entropy_blob sizeBytes = 7352 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/assets/geist-mono-cyrillic-500-normal-mNhfPmgl.woffView on unpkg

dist/ui/assets/index-B6hPk71b.jsView file

•path = dist/ui/assets/index-B6hPk71b.js kind = oversized_source_file sizeBytes = 3122107 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/assets/index-B6hPk71b.jsView on unpkg

Source & flagged code

5 flagged

dist/ui/assets/livescript-BwQOo05w.jsView file

Lines 1-2javascript

1var f=function(e,n){var g=n.next||"start";{n.next=n.next;var k=x[g];if(k.splice){for(var l=0;l<k.length;++l){var t=k[l];if(t.regex&&e.match(t.regex))return n.next=t.next||n.next,t.token}return e.next(),"error"}if(e.match(t=x[g]))return t.regex&&e.match(t.regex)?(n.next=t.next,t.token):(e.next(),"error")}return e.next(),"error"},s="(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*",u=RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|finally|import(?:\\s*all)?|const|var|let|new|catch(?:\\s*"+s+")?))\\s*$"),r="(?![$\\w]|-[A-Za-z]|\\s*:(?![:=]))",o={tok ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/assets/livescript-BwQOo05w.jsView on unpkg · L1

2

Long lines were clipped for display.

dist/bin/nakiros.jsView file

57}); L58: import { execSync } from "child_process"; L59: import { existsSync as existsSync85, mkdirSync as mkdirSync38, unlinkSync as unlinkSync10, writeFileSync as writeFileSync44 } from "fs"; ... L96: function guiTarget() { L97: return `gui/${process.getuid ? process.getuid() : process.env.UID ?? "501"}`; L98: } L99: function isServiceDisabled() { L100: const { ok, stdout } = launchctl(["print-disabled", guiTarget()]); L101: if (!ok) return false; ... L422: import Fastify from "fastify"; L423: import fastifyWebsocket from "@fastify/websocket"; L424: import fastifyStatic from "@fastify/static";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/bin/nakiros.jsView on unpkg · L57

57}); L58: import { execSync } from "child_process"; L59: import { existsSync as existsSync85, mkdirSync as mkdirSync38, unlinkSync as unlinkSync10, writeFileSync as writeFileSync44 } from "fs"; ... L96: function guiTarget() { L97: return `gui/${process.getuid ? process.getuid() : process.env.UID ?? "501"}`; L98: } L99: function isServiceDisabled() { L100: const { ok, stdout } = launchctl(["print-disabled", guiTarget()]); L101: if (!ok) return false; ... L422: import Fastify from "fastify"; L423: import fastifyWebsocket from "@fastify/websocket"; L424: import fastifyStatic from "@fastify/static";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/bin/nakiros.jsView on unpkg · L57

dist/ui/assets/geist-mono-cyrillic-500-normal-mNhfPmgl.woffView file

•path = dist/ui/assets/geist-mono-cyrillic-500-normal-mNhfPmgl.woff kind = high_entropy_blob sizeBytes = 7352 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/assets/geist-mono-cyrillic-500-normal-mNhfPmgl.woffView on unpkg

dist/ui/assets/index-B6hPk71b.jsView file

•path = dist/ui/assets/index-B6hPk71b.js kind = oversized_source_file sizeBytes = 3122107 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/ui/assets/index-B6hPk71b.jsView on unpkg