Loading npm security reports…

@patchstack/connect: Suspicious npm security report (Warn) | LPM Firewall

registry / @patchstack/connect / 0.5.32

@patchstack/connect@0.5.32

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed attack surface was identified. Inspected reporting, authentication, and runtime verification behavior supports the package's application security functionality.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Reporting requires a function call or CLI command; no automatic registry-install attack trigger was found.

Impact

No credential theft, remote payload execution, or malicious persistence was established.

Mechanism

Dependency inventory is sent to the configured API, while endpoint checks guard project-file overrides and the verification helper refuses additional processes.

AI rationale

Inspected source supports ordinary security reporting and service authentication, rather than the scanner's exfiltration and gateway claims. Process and metadata references implement runtime verification containment and SSRF classification, with no concrete malicious chain found.

Network endpoints2

api.patchstack.com/monitor/pulse/manifestapi.patchstack.com

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Source & flagged code

7 flagged · loading source

dist/protect/runtime/report-listeners.cjsView file

34const https = require('node:https'); L35: const childProcess = require('node:child_process'); L36: const workerThreads = require('node:worker_threads');

High

Child Process

Package source references child process execution.

dist/protect/runtime/report-listeners.cjsView on unpkg · L34

dist/protect.edge.jsView file

284if (typeof response.text === "function") { L285: const text = await response.text(); L286: if (new TextEncoder().encode(text).byteLength > maxBytes) { ... L320: // src/protect/engine/client.js L321: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L322: var DEFAULT_CACHE_TTL = 3e5; ... L334: this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4; L335: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L336: this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint"); ... L359: headers, L360: body: JSON.stringify({}), L361: signal: AbortSignal.timeout(this.#timeoutMs)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L284

6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

dist/index.jsView file

28try { L29: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L30: } catch { ... L34: try { L35: parsed = JSON.parse(raw); L36: } catch { ... L1218: }; L1219: function detectHostingPlatform(env = process.env) { L1220: for (const rule of RULES) { ... L1418: }, L1419: body: JSON.stringify({ L1420: grant_type: "client_credentials",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L28

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: writeFileSync function atomicWriteFileSync(target, content, options = {}) { writeFileSync(descriptor, content, options.encoding); atomicWriteFileSync(resolved.path, content, options); function safeBaseUrl(candidate, fallback, label) { return token === null ? {} : { Authorization: `Bearer ${token}` }; return { response, authenticated: auth.Authorization !== void 0 }; return "Patchstack needs this project's API key, and none is set here. Run npx @patchstack/connect login, or set PATCHSTACK_API_KEY.";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

58Cross-file remote execution chain: dist/cli.js spawns dist/protect/templates/fetch-guard.ts; helper contains network access plus dynamic code execution. L58: const code = error.code; L59: if (process.platform !== "win32" || code !== "EEXIST" && code !== "EPERM") throw error; L60: try { ... L156: try { L157: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L158: } catch { ... L162: try { L163: parsed = JSON.parse(raw); L164: } catch { ... L1361: }; L1362: function detectHostingPlatform(env = process.env) { L1363: for (const rule of RULES) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L58

dist/index.cjsView file

87Trigger-reachable chain: manifest.main -> dist/index.cjs L87: try { L88: raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8"); L89: } catch { ... L93: try { L94: parsed = JSON.parse(raw); L95: } catch { ... L1277: }; L1278: function detectHostingPlatform(env = process.env) { L1279: for (const rule of RULES) { ... L1477: }, L1478: body: JSON.stringify({ L1479: grant_type: "client_credentials",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L87

Source & flagged code

7 flagged

dist/protect/runtime/report-listeners.cjsView file

Lines 14-54javascript

14//

15// A worker THREAD does load this file, and its listeners are moved to loopback like any other, but a

16// worker has no `process.send`, so its reports cannot leave it. Containment holds and observation does

17// not — which would make a pass drawn from the main thread's listeners a pass for part of an app. So

18// worker creation is reported and the run declines. A worker given a replacement `env` does not load

19// this file at all (a worker's `execArgv` does not carry a preload, so `NODE_OPTIONS` is the only route

20// in), and is refused rather than allowed to bind outside the reporter.

21//

22// What is reported is bounded and names no content. An argument to one of these calls can be a whole

23// shell command line, and a startup command commonly carries a token or a password; a verifier that

24// copied one into its own diagnostics would put a secret in terminal or CI output that the app never

25// printed itself. So a launch is described by its launcher and the basename of its executable, and a

26// form whose argument is a command line is described by the fact that it is one.

27//

28// Reported over IPC rather than stdout: the app owns stdout, and a report that has to be parsed out of

29// arbitrary application output is a report that breaks the first time an app prints something similar.

30'use strict';

31

32const net = require('node:net');

33const http = require('node:http');

34const https = require('node:https');

35const childProcess = require('node:child_process');

36const workerThreads = require('node:worker_threads');

High

Child Process

Package source references child process execution.

dist/protect/runtime/report-listeners.cjsView on unpkg · L34

37const { basename } = require('node:path');

38

39const LOOPBACK = '127.0.0.1';

40

41/**

42 * Set once the parent says it has stopped listening.

43 *

44 * After this point a report would not be read, so a listener is refused rather than bound: a listener

45 * nobody is going to ask about must not exist, and the parent is about to end this process anyway.

46 */

47let frozen = false;

48

49function report(message) {

50 try {

51 if (typeof process.send === 'function') process.send(message);

52 } catch {

53 // The channel is the parent's to keep open. If it is gone there is nothing to tell and nothing to do

54 // about it, and this must not be what breaks the app it was preloaded into.

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6

dist/index.jsView file

Lines 8-48javascript

8 super(message);

9 this.code = code;

10 this.cause = cause;

11 this.name = "PatchstackError";

12 }

13 code;

dist/cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: writeFileSync function atomicWriteFileSync(target, content, options = {}) { writeFileSync(descriptor, content, options.encoding); atomicWriteFileSync(resolved.path, content, options); function safeBaseUrl(candidate, fallback, label) { return token === null ? {} : { Authorization: `Bearer ${token}` }; return { response, authenticated: auth.Authorization !== void 0 }; return "Patchstack needs this project's API key, and none is set here. Run npx @patchstack/connect login, or set PATCHSTACK_API_KEY.";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

58Cross-file remote execution chain: dist/cli.js spawns dist/protect/templates/fetch-guard.ts; helper contains network access plus dynamic code execution. L58: const code = error.code; L59: if (process.platform !== "win32" || code !== "EEXIST" && code !== "EPERM") throw error; L60: try { ... L156: try { L157: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L158: } catch { ... L162: try { L163: parsed = JSON.parse(raw); L164: } catch { ... L1361: }; L1362: function detectHostingPlatform(env = process.env) { L1363: for (const rule of RULES) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L58

dist/index.cjsView file

Lines 67-107javascript

67 super(message);

68 this.code = code;

69 this.cause = cause;

70 this.name = "PatchstackError";

71 }

72 code;