@nimbus-sh/worker@0.8.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@nimbus-sh/worker@0.8.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged · loading source

dist/facets/process.js#virtual:normalized:round1View file

1/** L2: * facet-process.ts — supervisor-side broker for child_process.spawn. L3: *

High

Child Process

Package source references child process execution.

dist/facets/process.js#virtual:normalized:round1View on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 39

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/facets/process.js#virtual:normalized:round1View on unpkg

public/_assets/real-vite-bundle.jsView file

200exports.xxhashBase36 = xxhashBase362; L201: function xxhashBase64Url2(input) { L202: let deferred1_0; ... L545: function getRollupUrl(snippet) { L546: return `https://rollupjs.org/${snippet}`; L547: } ... L1719: params: convertNodeList(buffer[position + 4], buffer), L1720: body: convertNode(buffer[position + 5], buffer), L1721: id: null ... L2377: }, "objectPattern"), L2378: /* @__PURE__ */ __name(function privateIdentifier(position, buffer) { L2379: return {

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

public/_assets/real-vite-bundle.jsView on unpkg · L200

•Remote response is passed to a worker and executed with Node capabilities. public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitelist of bundled // consumed by the post-patched __require2 call sites. // 2. __cirrusRealCjsRequire is a general CJS require polyfill that // works inside workerd. esbuild's built-in __require polyfill // uses `typeof require !== "undefined" ? require : throw`, which // always throws in workerd because the global `require` doesn't const _origCreateRequire = globalThis.__origCreateRequire || null; public/_assets/real-vite-bundle.js: // ── Cirrus real-vite bundler: __require2 + __require shim ─────── // 1. __cirrusRealRequireShim resolves a small whitel

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

public/_assets/real-vite-bundle.jsView on unpkg

69352stdio: "inherit", L69353: shell: true L69354: });

High

Shell

Package source references shell execution.

public/_assets/real-vite-bundle.jsView on unpkg · L69352

22909} L22910: currentGlobal = currentGlobal[pathSegment]; L22911: if (!currentGlobal) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

public/_assets/real-vite-bundle.jsView on unpkg · L22909

200exports.xxhashBase36 = xxhashBase362; L201: function xxhashBase64Url2(input) { L202: let deferred1_0; ... L545: function getRollupUrl(snippet) { L546: return `https://rollupjs.org/${snippet}`; L547: } ... L1719: params: convertNodeList(buffer[position + 4], buffer), L1720: body: convertNode(buffer[position + 5], buffer), L1721: id: null ... L2377: }, "objectPattern"), L2378: /* @__PURE__ */ __name(function privateIdentifier(position, buffer) { L2379: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

public/_assets/real-vite-bundle.jsView on unpkg · L200

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View file

780const subMod = { exports: {} }; L781: const subWrapped = new Function("module", "exports", "require", "__filename", "__dirname", c); L782: try { subWrapped(subMod, subMod.exports, nestedRequire, relAbs + ext, relAbs); }

High

Eval

Package source references dynamic code evaluation.

dist/facets/real-vite-fs-shim.js#virtual:normalized:round1View on unpkg · L780

dist/facets/wasm-swap-registry.js#virtual:normalized:round1View file

6* - swaps : name→name rewrite at the resolver/installer boundary. L7: * Only `compat: "drop-in"` swaps qualify (the consumer"s\n * `require()` call site works unchanged). Different-\n * require-name candidates (... L8: // `require(originalName)` call site. They are in `rejects`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facets/wasm-swap-registry.js#virtual:normalized:round1View on unpkg · L6

scripts/bundle-runtime.mjs#virtual:normalized:round1View file

31* For `clang binji-2020`, the upstream is: L32: * https://raw.githubusercontent.com/binji/wasm-clang/master/{clang,lld,sysroot.tar} L33: * ... L39: * L40: * Idempotent: re-running compares sha256 with what"s currently\n * uploaded; skips re-upload on match. Re-run is safe at any time.\n *\n * Requires CLOUDFLARE_ACCOUNT_ID env var + ... L41: * Only a publish to THIS bucket may rewrite the catalog pin: the pin

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/bundle-runtime.mjs#virtual:normalized:round1View on unpkg · L31

dist/facets/manager.jsView file

6Cross-file remote execution chain: dist/facets/manager.js spawns public/_assets/opencode/1.16.2/index.js; helper contains network access plus dynamic code execution. L6: * runaway script can't take the supervisor down. The script also needs L7: * supervisor-owned services: VFS writes, stdout/stderr, process exit, L8: * child-process brokering, and preview port routing. ... L11: * 1. LOADER.load(makeConfig) — isolated dynamic worker L12: * 2. worker.getEntrypoint().fetch() — executes the script L13: * 3. SUPERVISOR RPC — streams output and VFS writes ... L160: * - ASYNC OPERATIONS in flight (`__nimbusPendingOps`): a fetch, a response L161: * body read, an fs/child_process RPC. `await` resolves through L162: * PerformPromiseThen and surfaces nowhere els

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/facets/manager.jsView on unpkg · L6

scripts/bundle-real-vite.mjsView file

377const installCwd = path.resolve(ROOT, '..', '..'); L378: execSync(`bun add --no-save vite@${PINNED_VITE_VERSION} @rollup/wasm-node`, { L379: cwd: installCwd, stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/bundle-real-vite.mjsView on unpkg · L377

public/_assets/esbuild-0.24.2.wasmView file

•path = public/_assets/esbuild-0.24.2.wasm kind = wasm_module sizeBytes = 11907565 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

public/_assets/esbuild-0.24.2.wasmView on unpkg

public/_assets/opencode/1.16.2/index-attach.jsView file

•path = public/_assets/opencode/1.16.2/index-attach.js kind = oversized_source_file sizeBytes = 14433225 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

public/_assets/opencode/1.16.2/index-attach.jsView on unpkg

dist/facets/real-vite-fs-shim.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nimbus-sh/worker@0.6.0 matchedIdentity = npm:QG5pbWJ1cy1zaC93b3JrZXI:0.6.0 similarity = 0.658 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/facets/real-vite-fs-shim.jsView on unpkg