@patchstack/connect@0.3.30: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@patchstack/connect@0.3.30: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

4 flagged · loading source

dist/protect.edge.jsView file

57// src/protect/engine/client.js L58: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L59: var DEFAULT_CACHE_TTL = 3e5; ... L71: this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4; L72: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L73: this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint"); ... L96: headers, L97: body: JSON.stringify({}), L98: signal: AbortSignal.timeout(this.#timeoutMs) ... L112: } L113: const data = await response.json(); L114: if (!data || !Array.isArray(data.firewall)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L57

6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

dist/index.jsView file

22try { L23: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L24: } catch { ... L28: try { L29: parsed = JSON.parse(raw); L30: } catch { ... L1196: }, L1197: body: JSON.stringify({ L1198: grant_type: "client_credentials", ... L1222: } L1223: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1224: const send = async () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L22

dist/index.cjsView file

81Trigger-reachable chain: manifest.main -> dist/index.cjs L81: try { L82: raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8"); L83: } catch { ... L87: try { L88: parsed = JSON.parse(raw); L89: } catch { ... L1255: }, L1256: body: JSON.stringify({ L1257: grant_type: "client_credentials", ... L1281: } L1282: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1283: const send = async () => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L81

Source & flagged code

4 flagged

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6var __hasOwnProp = Object.prototype.hasOwnProperty;

7var __commonJS = (cb, mod) => function __require() {

8 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

9};

10var __copyProps = (to, from, except, desc) => {

11 if (from && typeof from === "object" || typeof from === "function") {

12 for (let key of __getOwnPropNames(from))

13 if (!__hasOwnProp.call(to, key) && key !== except)

14 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

15 }

16 return to;

17};

18var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

19 // If the importer is in node compatibility mode or this is not an ESM

20 // file that has been converted to a CommonJS file using a Babel-

21 // compatible transform (i.e. "__esModule" has not been set), then set

22 // "default" to the CommonJS "module.exports" for node compatibility.

23 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

24 mod

25));

26

Lines 37-77javascript

37 const u = new URL(value);

38 if (u.protocol === "https:") return true;

39 return u.protocol === "http:" &&

dist/index.jsView file

Lines 2-42javascript

2import { access } from "fs/promises";

3import path5 from "path";

4

5// src/types.ts

6var PatchstackError = class extends Error {

dist/index.cjsView file

Lines 61-101javascript

61var import_promises7 = require("fs/promises");

62var import_node_path5 = __toESM(require("path"), 1);

63

64// src/types.ts

65var PatchstackError