registry / @patchstack/connect / 0.4.2

@patchstack/connect@0.4.2

Runtime application security for JavaScript and Node.js: dependency inventory, attack-surface mapping, and an in-process guard that virtually patches known vulnerabilities and hardens responses.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

Remote vendor rules can choose request fields or raw request content for capture. The guard includes that capture data in authenticated detection posts to the vendor service.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A consumer runs setup or installs the runtime guard, then a request matches a vendor-supplied rule.

Impact

Sensitive request values, routes, client IP addresses, and user agents can leave the application.

Mechanism

Remote-rule-controlled request capture and detection reporting.

AI rationale

The runtime combines remote control over request capture with authenticated transmission of captured data to a package-controlled endpoint. Explicit setup does not remove the risk because it persists automatic hooks in the consumer project. Product guard normalized a non-low false-positive publish_block request to warn-only suspicious.

Evidence

dist/protect.cjsdist/cli.jspackage.json

Network endpoints1

api.patchstack.com

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Malware with medium false-positive risk.

Evidence for warning

The runtime fetches rules from the vendor service, allowing the service to control capture behavior.
A rule can select named request fields or raw request content, and captured values are retained in detection events.
Detection events, including capture data, are posted to the vendor endpoint with authentication.
The setup command rewrites a consumer project's install and build hooks to make scanning persistent.

Evidence against

The package manifest has no preinstall, install, or postinstall hook of its own.
The capture size is bounded and response data is explicitly excluded, but request values can still contain secrets.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 1.22 MB of source, external domains: api.patchstack.com, app.patchstack.com, cdn.patchstack.com, patchstack.com, patchstack.local

Source & flagged code

9 flagged

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6var __hasOwnProp = Object.prototype.hasOwnProperty;

7var __commonJS = (cb, mod) => function __require() {

8 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

9 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

10 } catch (e) {

11 throw mod = 0, e;

12 }

13};

14var __copyProps = (to, from, except, desc) => {

15 if (from && typeof from === "object" || typeof from === "function") {

16 for (let key of __getOwnPropNames(from))

17 if (!__hasOwnProp.call(to, key) && key !== except)

18 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

19 }

20 return to;

21};

22var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

23 // If the importer is in node compatibility mode or this is not an ESM

24 // file that has been converted to a CommonJS file using a Babel-

25 // compatible transform (i.e. "__esModule" has not been set), then set

26 // "default" to the CommonJS "module.exports" for node compatibility.

Lines 255-295javascript

255 const u = new URL(value);

256 if (u.protocol === "https:") return true;

257 return u.protocol === "http:" && (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "[::1]" || u.hostname === "::1");

258 } catch {

259 return false;

260 }

261}

262function safeBaseUrl(candidate, fallback, label) {

263 if (typeof candidate !== "string" || candidate === "") return fallback;

264 if (isSafeOrigin(candidate)) return candidate;

265 warnOnce(label, `[patchstack] ignoring unsafe ${label} override (${candidate}): must be https (or localhost). Using the default.`);

266 return fallback;

267}

268var warned = /* @__PURE__ */ new Set();

269function warnOnce(key, message) {

270 if (warned.has(key)) return;

271 warned.add(key);

272 console.warn(message);

273}

274

275// src/protect/engine/client.js

276var DEFAULT_BASE_URL = "https://api.patchstack.com";

277var DEFAULT_CACHE_TTL = 3e5;

278var JITTER_FRACTION = 0.1;

279var PatchstackRuleClient = class {

280 #token;

281 #baseUrl;

282 #cacheTtl;

283 #cache = null;

284 #cacheTime = null;

285 #ttlEffective = 0;

286 #etag;

287 #timeoutMs;

288 constructor({ token, baseUrl, cacheTtl, etag, timeoutMs } = {}) {

289 this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4;

290 this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN;

291 this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint");

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L275

292 this.#cacheTtl = Number.isFinite(cacheTtl) && cacheTtl > 0 ? cacheTtl : DEFAULT_CACHE_TTL;

293 this.#etag = etag ?? null;

294 if (!this.#token) {

295 throw new Error("Patchstack WAF token is required. Pass { token } or set PATCHSTACK_WAF_TOKEN env var.");

dist/index.jsView file

Lines 2-42javascript

2import { access } from "fs/promises";

3import path5 from "path";

5// src/types.ts

6var PatchstackError = class extends Error {

7 constructor(message, code, cause) {

8 super(message);

9 this.code = code;

10 this.cause = cause;

11 this.name = "PatchstackError";

12 }

13 code;

14 cause;

15};

17// src/parsers/consistency.ts

18import { readFile } from "fs/promises";

19import path from "path";

20async function readDeclaredDependencyNames(cwd) {

21 let raw;

22 try {

23 raw = await readFile(path.join(cwd, "package.json"), "utf8");

24 } catch {

25 return [];

26 }

27 let parsed;

28 try {

29 parsed = JSON.parse(raw);

30 } catch {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L22

31 return [];

32 }

33 if (typeof parsed !== "object" || parsed === null) {

34 return [];

35 }

36 const names = /* @__PURE__ */ new Set();

37 for (const group of ["dependencies", "devDependencies", "optionalDependencies"]) {

38 const deps = parsed[group];

39 if (typeof deps !== "object" || deps === null) {

40 continue;

41 }

42 for (const [name, spec] of Object.entries(deps)) {

dist/index.cjsView file

Lines 61-101javascript

61var import_promises7 = require("fs/promises");

62var import_node_path5 = __toESM(require("path"), 1);

64// src/types.ts

65var PatchstackError = class extends Error {

66 constructor(message, code, cause) {

67 super(message);

68 this.code = code;

69 this.cause = cause;

70 this.name = "PatchstackError";

71 }

72 code;

73 cause;

74};

76// src/parsers/consistency.ts

77var import_promises = require("fs/promises");

78var import_node_path = __toESM(require("path"), 1);

79async function readDeclaredDependencyNames(cwd) {

80 let raw;

81 try {

82 raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8");

83 } catch {

84 return [];

85 }

86 let parsed;

87 try {

88 parsed = JSON.parse(raw);

89 } catch {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L81

90 return [];

91 }

92 if (typeof parsed !== "object" || parsed === null) {

93 return [];

94 }

95 const names = /* @__PURE__ */ new Set();

96 for (const group of ["dependencies", "devDependencies", "optionalDependencies"]) {

97 const deps = parsed[group];

98 if (typeof deps !== "object" || deps === null) {

99 continue;

100 }

101 for (const [name, spec] of Object.entries(deps)) {

•matchType = normalized_sha256 matchedPackage = @patchstack/connect@0.4.0 matchedPath = dist/index.cjs matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.3.31 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.3.31 similarity = 0.818 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @patchstack/connect@0.4.0 matchedPath = dist/cli.js matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 051c43be5e104564 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @patchstack/connect@0.4.0 matchedPath = dist/cli.js matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.4.0 similarity = 1.000 shingleOverlap = 24 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

dist/protect.cjsView file

•matchType = normalized_sha256 matchedPackage = @patchstack/connect@0.4.0 matchedPath = dist/protect.cjs matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.4.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/protect.cjsView on unpkg

Source & flagged code

9 flagged · loading source

dist/protect.edge.jsView file

275// src/protect/engine/client.js L276: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L277: var DEFAULT_CACHE_TTL = 3e5; ... L289: this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4; L290: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L291: this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint"); ... L314: headers, L315: body: JSON.stringify({}), L316: signal: AbortSignal.timeout(this.#timeoutMs) ... L330: } L331: const data = await response.json(); L332: if (!data || !Array.isArray(data.firewall)) {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L275

6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

dist/index.jsView file

22try { L23: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L24: } catch { ... L28: try { L29: parsed = JSON.parse(raw); L30: } catch { ... L1226: }, L1227: body: JSON.stringify({ L1228: grant_type: "client_credentials", ... L1252: } L1253: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1254: const send = async () => {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L22

dist/index.cjsView file

81Trigger-reachable chain: manifest.main -> dist/index.cjs L81: try { L82: raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8"); L83: } catch { ... L87: try { L88: parsed = JSON.parse(raw); L89: } catch { ... L1285: }, L1286: body: JSON.stringify({ L1287: grant_type: "client_credentials", ... L1311: } L1312: async function pulseFetch(config, url, init, fetchImpl = fetch) { L1313: const send = async () => {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L81

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.cjsView on unpkg

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/cli.jsView on unpkg

dist/protect.cjsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/protect.cjsView on unpkg

Findings

3 Critical5 High4 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.cjs

CriticalPrevious Version Dangerous Deltadist/cli.js

HighCloud Metadata Accessdist/protect.edge.js

HighKnown Malware Source Similaritydist/cli.js

HighKnown Malware Source Similaritydist/protect.cjs

HighKnown Malware Source Similaritydist/index.cjs

HighKnown Malware Source Fingerprint Signaturedist/cli.js

MediumDynamic Requiredist/protect.edge.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @patchstack/connect@0.4.2.

See version security history for other recorded verdicts.

Review the evidence and your use of @patchstack/connect@0.4.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-08 10:26:46.037Z (UTC).

94%Suspicious

AI assessment confidence

IntentMalware

TypeData Exfiltration

False-positive riskMedium

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

Maintainerspatchstack_elliot

Version0.4.2

Latest on npm0.5.34

PublishedSep 8, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size530 KB

Files40

Keywordspatchstacksecurityapplication-securitynodejs-securityruntime-securityraspvirtual-patchingwaf

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.cjsmodule → ./dist/index.jstypes → ./dist/index.d.tsexports mapbin → patchstack-connect

Runtimenode >=18

Artifact2.10 MB · 40 files1 signature(s) · provenance

Install lifecycleprepareprepublishOnly

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean