@nimbus-sh/worker@0.4.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@nimbus-sh/worker@0.4.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

15 flagged · loading source

dist/facets/vite-dev-server.jsView file

402const NODE_BUILTINS = new Set([ L403: 'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'constants', L404: 'crypto', 'dgram', 'dns', 'domain', 'events', 'fs', 'fs/promises', 'http',

High

Child Process

Package source references child process execution.

dist/facets/vite-dev-server.jsView on unpkg · L402

62.then(function(r) { return r.text(); }) L63: .then(function(js) { try { new Function(js)(); } catch(e) {} }); L64: }

High

Eval

Package source references dynamic code evaluation.

dist/facets/vite-dev-server.jsView on unpkg · L62

public/_assets/real-vite-bundle.jsView file

200exports.xxhashBase36 = xxhashBase362; L201: function xxhashBase64Url2(input) { L202: let deferred1_0; ... L545: function getRollupUrl(snippet) { L546: return `https://rollupjs.org/${snippet}`; L547: } ... L1719: params: convertNodeList(buffer[position + 4], buffer), L1720: body: convertNode(buffer[position + 5], buffer), L1721: id: null ... L2377: }, "objectPattern"), L2378: /* @__PURE__ */ __name(function privateIdentifier(position, buffer) { L2379: return {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

public/_assets/real-vite-bundle.jsView on unpkg · L200

•Remote response is passed to a worker and executed with Node capabilities. public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitelist of bundled // consumed by the post-patched __require2 call sites. // 2. __cirrusRealCjsRequire is a general CJS require polyfill that // works inside workerd. esbuild's built-in __require polyfill // uses `typeof require !== "undefined" ? require : throw`, which // always throws in workerd because the global `require` doesn't const _origCreateRequire = globalThis.__origCreateRequire || null; public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitel

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

public/_assets/real-vite-bundle.jsView on unpkg

69352stdio: "inherit", L69353: shell: true L69354: });

High

Shell

Package source references shell execution.

public/_assets/real-vite-bundle.jsView on unpkg · L69352

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 12

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

public/_assets/real-vite-bundle.jsView on unpkg

200exports.xxhashBase36 = xxhashBase362; L201: function xxhashBase64Url2(input) { L202: let deferred1_0; ... L545: function getRollupUrl(snippet) { L546: return `https://rollupjs.org/${snippet}`; L547: } ... L1719: params: convertNodeList(buffer[position + 4], buffer), L1720: body: convertNode(buffer[position + 5], buffer), L1721: id: null ... L2377: }, "objectPattern"), L2378: /* @__PURE__ */ __name(function privateIdentifier(position, buffer) { L2379: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

public/_assets/real-vite-bundle.jsView on unpkg · L200

dist/facets/wasm-swap-registry.js#virtual:normalized:round1View file

6* - swaps : name→name rewrite at the resolver/installer boundary. L7: * Only `compat: "drop-in"` swaps qualify (the consumer"s\n * `require()` call site works unchanged). Different-\n * require-name candidates (... L8: // `require(originalName)` call site. They are in `rejects`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facets/wasm-swap-registry.js#virtual:normalized:round1View on unpkg · L6

dist/git-bundle.generated.jsView file

12*/ L13: export const GIT_BUNDLE_CODE = "var __create = Object.create;\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropName... L14: export const GIT_BUNDLE_SIZE = 492322;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/git-bundle.generated.jsView on unpkg · L12

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/git-bundle.generated.js: export const GIT_BUNDLE_CODE = "var __create = Object.create;\nvar __defProp = Object.defineProperty;\nvar __getOwnPropDesc = Object.getOwnPropertyDescriptor;\nvar __getOwnPropName...

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/git-bundle.generated.jsView on unpkg

dist/facets/manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nimbus-sh/worker@0.3.0 matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.3.0 similarity = 0.883 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/facets/manager.jsView on unpkg

6Cross-file remote execution chain: dist/facets/manager.js spawns public/_assets/opencode/1.16.2/index.js; helper contains network access plus dynamic code execution. L6: * runaway script can't take the supervisor down. The script also needs L7: * supervisor-owned services: VFS writes, stdout/stderr, process exit, L8: * child-process brokering, and preview port routing. ... L11: * 1. LOADER.load(makeConfig) — isolated dynamic worker L12: * 2. worker.getEntrypoint().fetch() — executes the script L13: * 3. SUPERVISOR RPC — streams output and VFS writes ... L175: * - ASYNC OPERATIONS in flight (`__nimbusPendingOps`): a fetch, a response L176: * body read, an fs/child_process RPC. `await` resolves through L177: * PerformPromiseThen and surfaces nowhere els

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/facets/manager.jsView on unpkg · L6

scripts/bundle-real-vite.mjsView file

377const installCwd = path.resolve(ROOT, '..', '..'); L378: execSync(`bun add --no-save vite@${PINNED_VITE_VERSION} @rollup/wasm-node`, { L379: cwd: installCwd, stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/bundle-real-vite.mjsView on unpkg · L377

public/_assets/esbuild-0.24.2.wasmView file

•path = public/_assets/esbuild-0.24.2.wasm kind = wasm_module sizeBytes = 11907565 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/_assets/esbuild-0.24.2.wasmView on unpkg

public/_assets/opencode/1.16.2/index-attach.jsView file

•path = public/_assets/opencode/1.16.2/index-attach.js kind = oversized_source_file sizeBytes = 14433225 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

public/_assets/opencode/1.16.2/index-attach.jsView on unpkg

Source & flagged code

15 flagged

dist/facets/vite-dev-server.jsView file

Lines 42-82javascript

42// Nimbus HMR Client — listens for reload messages from parent

43(function() {

44 window.__NIMBUS_HMR = true;

45 window.addEventListener('message', function(e) {

46 if (e.data && e.data.type === 'nimbus-hmr') {

47 if (e.data.event === 'full-reload') {

48 console.log('[nimbus-hmr] full reload');

49 location.reload();

50 } else if (e.data.event === 'css-update') {

51 // Reload all stylesheets

52 document.querySelectorAll('link[rel="stylesheet"]').forEach(function(l) {

53 var href = l.href;

54 l.href = '';

55 l.href = href + (href.includes('?') ? '&' : '?') + 't=' + Date.now();

56 });

57 // Re-fetch injected style tags

58 document.querySelectorAll('style[data-vite-dev-id]').forEach(function(s) {

59 var id = s.getAttribute('data-vite-dev-id');

60 if (id) {

61 fetch(id + '?import&t=' + Date.now())

62 .then(function(r) { return r.text(); })

63 .then(function(js) { try { new Function(js)(); } catch(e) {} });

64 }

High

Eval

Package source references dynamic code evaluation.

dist/facets/vite-dev-server.jsView on unpkg · L62

65 });

66 }

67 }

68 });

69 console.log('[nimbus-hmr] connected');

70})();

71</script>`;

72/**

73 * Runtime-error overlay injected into the served index.html.

74 *

75 * Catches:

76 * - window 'error' events (uncaught synchronous throws + <script type="module"> load failures)

77 * - window 'unhandledrejection' events (promise rejections)

78 *

79 * Renders a red banner at the top of the page with:

80 * - the error message

81 * - a hint to run `npm install` when the message looks like a module-resolution error

82 * - a Reload button

Lines 382-422javascript

382 * makeModuleUrl('', 'react') → '/@modules/react' (empty/undefined)

383 * makeModuleUrl(undefined, 'react') → '/@modules/react' (undefined)

384 *

public/_assets/real-vite-bundle.jsView file

200exports.xxhashBase36 = xxhashBase362; L201: function xxhashBase64Url2(input) { L202: let deferred1_0; ... L545: function getRollupUrl(snippet) { L546: return `https://rollupjs.org/${snippet}`; L547: } ... L1719: params: convertNodeList(buffer[position + 4], buffer), L1720: body: convertNode(buffer[position + 5], buffer), L1721: id: null ... L2377: }, "objectPattern"), L2378: /* @__PURE__ */ __name(function privateIdentifier(position, buffer) { L2379: return {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

public/_assets/real-vite-bundle.jsView on unpkg · L200

•Remote response is passed to a worker and executed with Node capabilities. public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitelist of bundled // consumed by the post-patched __require2 call sites. // 2. __cirrusRealCjsRequire is a general CJS require polyfill that // works inside workerd. esbuild's built-in __require polyfill // uses `typeof require !== "undefined" ? require : throw`, which // always throws in workerd because the global `require` doesn't const _origCreateRequire = globalThis.__origCreateRequire || null; public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitel

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

public/_assets/real-vite-bundle.jsView on unpkg

dist/facets/wasm-swap-registry.js#virtual:normalized:round1View file

6* - swaps : name→name rewrite at the resolver/installer boundary. L7: * Only `compat: "drop-in"` swaps qualify (the consumer"s\n * `require()` call site works unchanged). Different-\n * require-name candidates (... L8: // `require(originalName)` call site. They are in `rejects`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facets/wasm-swap-registry.js#virtual:normalized:round1View on unpkg · L6

dist/git-bundle.generated.jsView file

Lines 1-15javascript

1/**

2 * git-bundle.generated.ts — AUTO-GENERATED. DO NOT EDIT.

3 *

4 * Produced by scripts/bundle-git.mjs from:

5 * - isomorphic-git (github:AshishKumar4/cf-git)

6 * - isomorphic-git/http/web

7 *

8 * Consumed by git-network-facet.ts: passed to LOADER.load()'s

9 * `modules` record so the facet can `import` isomorphic-git.

10 *

11 * Size: 480.8 KiB

dist/facets/manager.jsView file

Lines 1-26javascript

1/**

2 * facets/manager.ts — Lifecycle for isolated user-runtime workers.

3 *

4 * `node script.js` from the shell prompt has to run somewhere isolated

5 * — same memory bound as the supervisor (128 MiB) but separate so a

6 * runaway script can't take the supervisor down. The script also needs

7 * supervisor-owned services: VFS writes, stdout/stderr, process exit,

8 * child-process brokering, and preview port routing.

9 *

10 * One-shot commands use a stateless dynamic Worker entrypoint:

scripts/bundle-real-vite.mjsView file

377const installCwd = path.resolve(ROOT, '..', '..'); L378: execSync(`bun add --no-save vite@${PINNED_VITE_VERSION} @rollup/wasm-node`, { L379: cwd: installCwd, stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/bundle-real-vite.mjsView on unpkg · L377

public/_assets/esbuild-0.24.2.wasmView file

•path = public/_assets/esbuild-0.24.2.wasm kind = wasm_module sizeBytes = 11907565 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/_assets/esbuild-0.24.2.wasmView on unpkg

public/_assets/opencode/1.16.2/index-attach.jsView file

•path = public/_assets/opencode/1.16.2/index-attach.js kind = oversized_source_file sizeBytes = 14433225 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

public/_assets/opencode/1.16.2/index-attach.jsView on unpkg