@nebula.js/cli-serve@7.2.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@nebula.js/cli-serve@7.2.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/3535.jsView file

1"use strict";(self.webpackChunk_nebula_js_cli_serve=self.webpackChunk_nebula_js_cli_serve||[]).push([[3535],{13535(i,e,n){async function o(i,e){return e?.runtimeModuleMocks?.[i]?e.... L2: //# sourceMappingURL=3535.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/3535.jsView on unpkg · L1

lib/webpack.build.jsView file

17L18: const { version } = require('../package.json'); L19: ... L43: '@nebula.js/locale': path.resolve(moduleDir, '../../../apis/locale/src'), L44: fixtures: path.resolve(process.cwd(), serveConfig.fixturePath || ''), L45: }, ... L96: __NEBULA_DEV__: true, L97: 'process.env.NEBULA_VERSION': JSON.stringify(version), L98: 'process.env.NEBULA_VERSION_HASH': JSON.stringify(versionHash),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/webpack.build.jsView on unpkg · L17

lib/serve.jsView file

7Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network L7: import yargs from 'yargs'; L8: import { WebSocketServer } from 'ws'; L9: import chokidar from 'chokidar'; ... L41: [...ws.clients].forEach((client) => { L42: client.send( L43: JSON.stringify({ ... L74: file = require.resolve(name, { L75: paths: [process.cwd()], L76: }); ... L142: try { L143: const externalPkg = require(path.resolve(context, 'package.json')); L144: const externalEntry = serveConfig.mfe ? externalPkg.systemjs : externalPkg.main;

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

lib/serve.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @nebula.js/cli-serve@7.1.2 matchedPath = lib/serve.js matchedIdentity = npm:QG5lYnVsYS5qcy9jbGktc2VydmU:7.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/serve.jsView on unpkg

dist/eRender.jsView file

1/*! For license information please see eRender.js.LICENSE.txt */ L2: (()=>{var e={5216(e){e.exports=function(){"use strict";var e={};function t(){t.init.call(this)}e.isObject=function(e){return"object"==typeof e&&null!==e},e.isNumber=function(e){ret... L3: 0% {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/eRender.jsView on unpkg · L1

dist/eHub.jsView file

•path = dist/eHub.js kind = oversized_source_file sizeBytes = 5895765 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/eHub.jsView on unpkg

lib/init-config.jsView file

•matchType = normalized_sha256 matchedPackage = @nebula.js/cli-serve@7.1.2 matchedPath = lib/init-config.js matchedIdentity = npm:QG5lYnVsYS5qcy9jbGktc2VydmU:7.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/init-config.jsView on unpkg

Source & flagged code

7 flagged

dist/3535.jsView file

Lines 1-2javascript

1"use strict";(self.webpackChunk_nebula_js_cli_serve=self.webpackChunk_nebula_js_cli_serve||[]).push([[3535],{13535(i,e,n){async function o(i,e){return e?.runtimeModuleMocks?.[i]?e.runtimeModuleMocks?.[i]:(function(i){if(!window.__qlikMainPrivateResolvers)throw new Error("No main url resolver found");const e=function(i){if(!window.__qlikMainPrivateResolvers)throw new Error("No main url resolver found");let e,n=i?.embedRuntimeUrl||i?.url||i?.host;if(n||"noauth"!==i?.authType||(n="https://cdn.qlikcloud.com/qmfe"),n){for(e=n.toLowerCase().startsWith("https://")||n.toLowerCase().startsWith("http:// ...

2//# sourceMappingURL=3535.js.map

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/3535.jsView on unpkg · L1

Long lines were clipped for display.

lib/webpack.build.jsView file

Lines 1-37javascript

1import path from 'path';

2import crypto from 'crypto';

3import webpack from 'webpack';

4import HtmlWebpackPlugin from 'html-webpack-plugin';

lib/serve.jsView file

Lines 1-27javascript

1/* eslint-disable import/extensions */

2import path from 'path';

3import fs from 'fs';

4import { createRequire } from 'module';

5import portfinder from

dist/eRender.jsView file

1/*! For license information please see eRender.js.LICENSE.txt */ L2: (()=>{var e={5216(e){e.exports=function(){"use strict";var e={};function t(){t.init.call(this)}e.isObject=function(e){return"object"==typeof e&&null!==e},e.isNumber=function(e){ret... L3: 0% {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/eRender.jsView on unpkg · L1

dist/eHub.jsView file

•path = dist/eHub.js kind = oversized_source_file sizeBytes = 5895765 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/eHub.jsView on unpkg

lib/init-config.jsView file

•matchType = normalized_sha256 matchedPackage = @nebula.js/cli-serve@7.1.2 matchedPath = lib/init-config.js matchedIdentity = npm:QG5lYnVsYS5qcy9jbGktc2VydmU:7.1.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/init-config.jsView on unpkg