@nimbus-sh/worker: Suspicious npm security report (Warn)

Loading npm security reports…

@nimbus-sh/worker: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

23 flagged

dist/facets/process.js#virtual:normalized:round1View file

1/** L2: * facet-process.ts — supervisor-side broker for child_process.spawn. L3: *

High

Child Process

Package source references child process execution.

dist/facets/process.js#virtual:normalized:round1View on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 36

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/facets/process.js#virtual:normalized:round1View on unpkg

public/_assets/real-vite-bundle.jsView file

200exports.xxhashBase36 = xxhashBase362; L201: function xxhashBase64Url2(input) { L202: let deferred1_0; ... L545: function getRollupUrl(snippet) { L546: return `https://rollupjs.org/${snippet}`; L547: } ... L1719: params: convertNodeList(buffer[position + 4], buffer), L1720: body: convertNode(buffer[position + 5], buffer), L1721: id: null ... L2377: }, "objectPattern"), L2378: /* @__PURE__ */ __name(function privateIdentifier(position, buffer) { L2379: return {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

public/_assets/real-vite-bundle.jsView on unpkg · L200

•Remote response is passed to a worker and executed with Node capabilities. public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitelist of bundled // consumed by the post-patched __require2 call sites. // 2. __cirrusRealCjsRequire is a general CJS require polyfill that // works inside workerd. esbuild's built-in __require polyfill // uses `typeof require !== "undefined" ? require : throw`, which // always throws in workerd because the global `require` doesn't const _origCreateRequire = globalThis.__origCreateRequire || null; public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitel

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

public/_assets/real-vite-bundle.jsView on unpkg

69352stdio: "inherit", L69353: shell: true L69354: });

High

Shell

Package source references shell execution.

public/_assets/real-vite-bundle.jsView on unpkg · L69352

22909} L22910: currentGlobal = currentGlobal[pathSegment]; L22911: if (!currentGlobal) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

public/_assets/real-vite-bundle.jsView on unpkg · L22909

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = public/_assets/real-vite-bundle.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/real-vite-bundle.jsView on unpkg

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View file

780const subMod = { exports: {} }; L781: const subWrapped = new Function("module", "exports", "require", "__filename", "__dirname", c); L782: try { subWrapped(subMod, subMod.exports, nestedRequire, relAbs + ext, relAbs); }

High

Eval

Package source references dynamic code evaluation.

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View on unpkg · L780

dist/runtime/opencode-facet-runner.js#virtual:normalized:round1View file

65// "listening" is printed but no request can ever be routed to it (the L66: // empty-registry 502). CJS require("http") already resolves to this shim; L67: // this bridge gives the ESM `import "node:http"` chunks the same server.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/opencode-facet-runner.js#virtual:normalized:round1View on unpkg · L65

public/_assets/runtime/git-de3e60c9f3ff006a.jsView file

Lines 1-21javascript

dist/facets/manager.jsView file

6Cross-file remote execution chain: dist/facets/manager.js spawns public/_assets/opencode/1.16.2/index.js; helper contains network access plus dynamic code execution. L6: * runaway script can't take the supervisor down. The script also needs L7: * supervisor-owned services: VFS writes, stdout/stderr, process exit, L8: * child-process brokering, and preview port routing. ... L11: * 1. LOADER.load(makeConfig) — isolated dynamic worker L12: * 2. worker.getEntrypoint().fetch() — executes the script L13: * 3. SUPERVISOR RPC — streams output and VFS writes ... L183: * - ASYNC OPERATIONS in flight (`__nimbusPendingOps`): a fetch, a response L184: * body read, an fs/child_process RPC. `await` resolves through L185: * PerformPromiseThen and surfaces nowhere els

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/facets/manager.jsView on unpkg · L6

scripts/bundle-real-vite.mjsView file

377const installCwd = path.resolve(ROOT, '..', '..'); L378: execSync(`bun add --no-save vite@${PINNED_VITE_VERSION} @rollup/wasm-node`, { L379: cwd: installCwd, stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/bundle-real-vite.mjsView on unpkg · L377

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = scripts/bundle-real-vite.mjs matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-real-vite.mjsView on unpkg

public/_assets/esbuild-0.24.2.wasmView file

•path = public/_assets/esbuild-0.24.2.wasm kind = wasm_module sizeBytes = 11907565 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/_assets/esbuild-0.24.2.wasmView on unpkg

public/_assets/opencode/1.16.2/index-attach.jsView file

•path = public/_assets/opencode/1.16.2/index-attach.js kind = oversized_source_file sizeBytes = 14433323 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

public/_assets/opencode/1.16.2/index-attach.jsView on unpkg

scripts/bundle-plugin-react.mjsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = scripts/bundle-plugin-react.mjs matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-plugin-react.mjsView on unpkg

scripts/bundle-npm-cjs.mjsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = scripts/bundle-npm-cjs.mjs matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-npm-cjs.mjsView on unpkg

dist/facets/real-vite-fs-shim.jsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = dist/facets/real-vite-fs-shim.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/facets/real-vite-fs-shim.jsView on unpkg

public/_assets/opencode/1.16.2/index.jsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = public/_assets/opencode/1.16.2/index.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/opencode/1.16.2/index.jsView on unpkg

scripts/opentui/build-wasm.mjsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = scripts/opentui/build-wasm.mjs matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/opentui/build-wasm.mjsView on unpkg

public/_assets/tailwind-play.jsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = public/_assets/tailwind-play.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/tailwind-play.jsView on unpkg

dist/facets/vite-dev-server.jsView file

•matchType = normalized_sha256 matchedPackage = @nimbus-sh/worker@0.8.0 matchedPath = dist/facets/vite-dev-server.js matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/facets/vite-dev-server.jsView on unpkg

Source & flagged code

23 flagged · loading source

dist/facets/process.js#virtual:normalized:round1View file

1/** L2: * facet-process.ts — supervisor-side broker for child_process.spawn. L3: *

High

Child Process

Package source references child process execution.

dist/facets/process.js#virtual:normalized:round1View on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 36

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/facets/process.js#virtual:normalized:round1View on unpkg

public/_assets/real-vite-bundle.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

public/_assets/real-vite-bundle.jsView on unpkg · L200

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

public/_assets/real-vite-bundle.jsView on unpkg

69352stdio: "inherit", L69353: shell: true L69354: });

High

Shell

Package source references shell execution.

public/_assets/real-vite-bundle.jsView on unpkg · L69352

22909} L22910: currentGlobal = currentGlobal[pathSegment]; L22911: if (!currentGlobal) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

public/_assets/real-vite-bundle.jsView on unpkg · L22909

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/real-vite-bundle.jsView on unpkg

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View file

High

Eval

Package source references dynamic code evaluation.

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View on unpkg · L780

dist/runtime/opencode-facet-runner.js#virtual:normalized:round1View file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/opencode-facet-runner.js#virtual:normalized:round1View on unpkg · L65

public/_assets/runtime/git-de3e60c9f3ff006a.jsView file

1var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L2: `));var retLines=[],linesAndNewlines=value.split(/(\n|\r\n)/);linesAndNewlines[linesAndNewlines.length-1]||linesAndNewlines.pop();for(var i=0;i<linesAndNewlines.length;i++){var lin... L3: `)}static async _entryToBuffer(entry){let bpath=Buffer.from(entry.path),length=Math.ceil((62+bpath.length+1)/8)*8,written=Buffer.alloc(length),writer=new BufferCursor(written),stat...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

public/_assets/runtime/git-de3e60c9f3ff006a.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

public/_assets/runtime/git-de3e60c9f3ff006a.jsView on unpkg · L1

dist/facets/manager.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/facets/manager.jsView on unpkg · L6

scripts/bundle-real-vite.mjsView file

377const installCwd = path.resolve(ROOT, '..', '..'); L378: execSync(`bun add --no-save vite@${PINNED_VITE_VERSION} @rollup/wasm-node`, { L379: cwd: installCwd, stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/bundle-real-vite.mjsView on unpkg · L377

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-real-vite.mjsView on unpkg

public/_assets/esbuild-0.24.2.wasmView file

•path = public/_assets/esbuild-0.24.2.wasm kind = wasm_module sizeBytes = 11907565 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/_assets/esbuild-0.24.2.wasmView on unpkg

public/_assets/opencode/1.16.2/index-attach.jsView file

•path = public/_assets/opencode/1.16.2/index-attach.js kind = oversized_source_file sizeBytes = 14433323 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

public/_assets/opencode/1.16.2/index-attach.jsView on unpkg

scripts/bundle-plugin-react.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-plugin-react.mjsView on unpkg

scripts/bundle-npm-cjs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-npm-cjs.mjsView on unpkg

dist/facets/real-vite-fs-shim.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/facets/real-vite-fs-shim.jsView on unpkg

public/_assets/opencode/1.16.2/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/opencode/1.16.2/index.jsView on unpkg

scripts/opentui/build-wasm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/opentui/build-wasm.mjsView on unpkg

public/_assets/tailwind-play.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/tailwind-play.jsView on unpkg

dist/facets/vite-dev-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/facets/vite-dev-server.jsView on unpkg

Source & flagged code

23 flagged

dist/facets/process.js#virtual:normalized:round1View file

1/** L2: * facet-process.ts — supervisor-side broker for child_process.spawn. L3: *

High

Child Process

Package source references child process execution.

dist/facets/process.js#virtual:normalized:round1View on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 36

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/facets/process.js#virtual:normalized:round1View on unpkg

public/_assets/real-vite-bundle.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

public/_assets/real-vite-bundle.jsView on unpkg · L200

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

public/_assets/real-vite-bundle.jsView on unpkg

69352stdio: "inherit", L69353: shell: true L69354: });

High

Shell

Package source references shell execution.

public/_assets/real-vite-bundle.jsView on unpkg · L69352

22909} L22910: currentGlobal = currentGlobal[pathSegment]; L22911: if (!currentGlobal) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

public/_assets/real-vite-bundle.jsView on unpkg · L22909

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/real-vite-bundle.jsView on unpkg

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View file

High

Eval

Package source references dynamic code evaluation.

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View on unpkg · L780

dist/runtime/opencode-facet-runner.js#virtual:normalized:round1View file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/runtime/opencode-facet-runner.js#virtual:normalized:round1View on unpkg · L65

public/_assets/runtime/git-de3e60c9f3ff006a.jsView file

Lines 1-21javascript

dist/facets/manager.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/facets/manager.jsView on unpkg · L6

scripts/bundle-real-vite.mjsView file

377const installCwd = path.resolve(ROOT, '..', '..'); L378: execSync(`bun add --no-save vite@${PINNED_VITE_VERSION} @rollup/wasm-node`, { L379: cwd: installCwd, stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/bundle-real-vite.mjsView on unpkg · L377

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-real-vite.mjsView on unpkg

public/_assets/esbuild-0.24.2.wasmView file

•path = public/_assets/esbuild-0.24.2.wasm kind = wasm_module sizeBytes = 11907565 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/_assets/esbuild-0.24.2.wasmView on unpkg

public/_assets/opencode/1.16.2/index-attach.jsView file

•path = public/_assets/opencode/1.16.2/index-attach.js kind = oversized_source_file sizeBytes = 14433323 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

public/_assets/opencode/1.16.2/index-attach.jsView on unpkg

scripts/bundle-plugin-react.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-plugin-react.mjsView on unpkg

scripts/bundle-npm-cjs.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/bundle-npm-cjs.mjsView on unpkg

dist/facets/real-vite-fs-shim.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/facets/real-vite-fs-shim.jsView on unpkg

public/_assets/opencode/1.16.2/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/opencode/1.16.2/index.jsView on unpkg

scripts/opentui/build-wasm.mjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/opentui/build-wasm.mjsView on unpkg

public/_assets/tailwind-play.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

public/_assets/tailwind-play.jsView on unpkg

dist/facets/vite-dev-server.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/facets/vite-dev-server.jsView on unpkg

@nimbus-sh/worker@0.11.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code