@ngocsangairvds/vsaf@6.7.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@ngocsangairvds/vsaf@6.7.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "const fs=require('fs'),p=require('path'),r=p.resolve;const d=r(process.cwd(),'node_modules','@vsaf');fs.mkdirSync(d,{recursive:true});const t=r(d,'core'),src=r(process.cwd...

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194 matchedText = - AKIA12... key

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

194patternName = aws_access_key severity = critical line = 194 matchedText = - AKIA12... key

Critical

Secret Pattern

AWS access key ID in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

195patternName = github_pat severity = critical line = 195 matchedText = - ghp_12...oken

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L195

packages/core/dist/isolation/workspace-manager.jsView file

7const crypto_1 = require("crypto"); L8: const child_process_1 = require("child_process"); L9: const util_1 = require("util");

High

Child Process

Package source references child process execution.

packages/core/dist/isolation/workspace-manager.jsView on unpkg · L7

packages/cli/dist/commands/doctor.jsView file

20const timer = setTimeout(() => controller.abort(), 3_000); L21: const response = await fetch(url, { L22: method: 'POST', L23: headers: { ...headers, 'Content-Type': 'application/x-protobuf' }, L24: body: new Uint8Array(0), L25: signal: controller.signal, ... L35: try { L36: const { stdout } = await exec(name, args); L37: const version = stdout.trim().match(/[\d.]+/)?.[0] ?? 'unknown';

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

packages/cli/dist/commands/doctor.jsView on unpkg · L20

20Trigger-reachable command-output exfiltration chain: manifest.bin -> packages/cli/dist/index.js -> [redacted].js L20: const timer = setTimeout(() => controller.abort(), 3_000); L21: const response = await fetch(url, { L22: method: 'POST', L23: headers: { ...headers, 'Content-Type': 'application/x-protobuf' }, L24: body: new Uint8Array(0), L25: signal: controller.signal, ... L35: try { L36: const { stdout } = await exec(name, args); L37: const version = stdout.trim().match(/[\d.]+/)?.[0] ?? 'unknown';

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

packages/cli/dist/commands/doctor.jsView on unpkg · L20

skills/sdlc/install-deps.mjsView file

14* 2. Checks/installs npm package: gitnexus (includes MCP server built-in) L15: * 3. Provisions .mcp.json with GitNexus MCP server entry (npx gitnexus mcp) L16: */ ... L19: import { join } from 'path'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/sdlc/install-deps.mjsView on unpkg · L14

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/web/dist/web/browser/chunk-O7TQGEFF.jsView on unpkg

packages/cli/dist/mcp/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ngocsangairvds/vsaf@6.6.0 matchedIdentity = npm:QG5nb2NzYW5nYWlydmRzL3ZzYWY:6.6.0 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/cli/dist/mcp/server.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

7patternName = generic_password severity = medium line = 7 matchedText = smtp_aut...ord'

Medium

Secret Pattern

Hardcoded password in skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.yml

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView on unpkg · L7

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132 matchedText = test_sec...2"}'

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136 matchedText = test_sec...4"}'

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135 matchedText = test_sec...0"}'

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135