@nocobase/cli@2.1.18: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@nocobase/cli@2.1.18: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

bin/run.jsView file

13const __dirname = path.dirname(fileURLToPath(import.meta.url)); L14: const requireFromCli = createRequire(import.meta.url); L15: const root = path.resolve(__dirname, '..');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run.jsView on unpkg · L13

dist/lib/runtime-generator.jsView file

6* This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License. L7: * For more information, please refer to: https://www.nocobase.com/agreement. L8: */ ... L79: function getMultipartRequestSchema(requestBody) { L80: return requestBody?.content?.['multipart/form-data']?.schema; L81: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/runtime-generator.jsView on unpkg · L6

dist/lib/session-integration.jsView file

6* This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License. L7: * For more information, please refer to: https://www.nocobase.com/agreement. L8: */ ... L16: */ L17: import { execFile, execFileSync } from 'node:child_process'; L18: import { promises as fs } from 'node:fs'; ... L31: function shellDir() { L32: return path.join(resolveCliHomeDir(), 'shell'); L33: } L34: function resolveSessionHomeDir() { L35: return process.env.HOME || process.env.USERPROFILE || os.homedir(); L36: }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/lib/session-integration.jsView on unpkg · L6

bin/run.cmdView file

•path = bin/run.cmd kind = build_helper sizeBytes = 31 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/run.cmdView on unpkg

dist/lib/proxy-caddy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nocobase/cli@2.1.17 matchedIdentity = npm:QG5vY29iYXNlL2NsaQ:2.1.17 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/proxy-caddy.jsView on unpkg

Source & flagged code

5 flagged

bin/run.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

2

3import { spawnSync } from 'node:child_process';

4import fs from 'node:fs';

5import { createRequire } from 'node:module';

6import path from 'node:path';

7import pc from 'picocolors';

8import { fileURLToPath, pathToFileURL } from 'node:url';

9import { formatUnsupportedNodeVersionMessage, isSupportedNodeVersion } from './node-version.js';

10import { normalizeNodeOptions, normalizeSessionEnv } from './session-env.js';

11import { ensureWindowsAdministrator } from './windows-admin.js';

12

13const __dirname = path.dirname(fileURLToPath(import.meta.url));

14const requireFromCli = createRequire(import.meta.url);

15const root = path.resolve(__dirname, '..');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/run.jsView on unpkg · L13

16const realRoot = fs.realpathSync(root);

17const isSourcePackage = realRoot.split(path.sep).join('/').endsWith('/packages/core/cli');

18let isDev = isSourcePackage;

19if (process.env.NB_CLI_USE_DIST === '1') {

20 isDev = false;

21}

22

23if (!isSupportedNodeVersion()) {

24 console.error(pc.red(formatUnsupportedNodeVersionMessage(process.version)));

25 process.exit(1);

26}

27

28normalizeSessionEnv();

29normalizeNodeOptions();

30

31ensureWindowsAdministrator();

32

33/**

dist/lib/runtime-generator.jsView file

Lines 1-26javascript

1/**

2 * This file is part of the NocoBase (R) project.

3 * Copyright (c) 2020-2024 NocoBase Co., Ltd.

4 * Authors: NocoBase Team.

5 *

6 * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.

7 * For more information, please refer to: https://www.nocobase.com/agreement.

8 */

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/lib/runtime-generator.jsView on unpkg · L6

9

dist/lib/session-integration.jsView file

Lines 1-26javascript

1/**

2 * This file is part of the NocoBase (R) project.

3 * Copyright (c) 2020-2024 NocoBase Co., Ltd.

4 * Authors: NocoBase Team.

5 *

6 * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.

7 * For more information, please refer to: https://www.nocobase.com/agreement.

8 */

9/**

10 * This file is part of the NocoBase (R) project.

11

bin/run.cmdView file

•path = bin/run.cmd kind = build_helper sizeBytes = 31 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/run.cmdView on unpkg

dist/lib/proxy-caddy.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @nocobase/cli@2.1.17 matchedIdentity = npm:QG5vY29iYXNlL2NsaQ:2.1.17 similarity = 0.958 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lib/proxy-caddy.jsView on unpkg