@patchstack/connect@0.5.11: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@patchstack/connect@0.5.11: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/protect.edge.jsView file

284if (typeof response.text === "function") { L285: const text = await response.text(); L286: if (new TextEncoder().encode(text).byteLength > maxBytes) { ... L320: // src/protect/engine/client.js L321: var DEFAULT_BASE_URL = "https://api.patchstack.com"; L322: var DEFAULT_CACHE_TTL = 3e5; ... L334: this.#timeoutMs = Number(timeoutMs) > 0 ? Number(timeoutMs) : 3e4; L335: this.#token = token ?? process.env.PATCHSTACK_WAF_TOKEN; L336: this.#baseUrl = safeBaseUrl(baseUrl ?? process.env.PATCHSTACK_WAF_API_URL, DEFAULT_BASE_URL, "rule endpoint"); ... L359: headers, L360: body: JSON.stringify({}), L361: signal: AbortSignal.timeout(this.#timeoutMs)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/protect.edge.jsView on unpkg · L284

6var __hasOwnProp = Object.prototype.hasOwnProperty; L7: var __commonJS = (cb, mod) => function __require() { L8: try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

dist/index.jsView file

28try { L29: raw = await readFile(path.join(cwd, "package.json"), "utf8"); L30: } catch { ... L34: try { L35: parsed = JSON.parse(raw); L36: } catch { ... L1211: }; L1212: function detectHostingPlatform(env = process.env) { L1213: for (const rule of RULES) { ... L1408: }, L1409: body: JSON.stringify({ L1410: grant_type: "client_credentials",

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/index.jsView on unpkg · L28

dist/index.cjsView file

87Trigger-reachable chain: manifest.main -> dist/index.cjs L87: try { L88: raw = await (0, import_promises.readFile)(import_node_path.default.join(cwd, "package.json"), "utf8"); L89: } catch { ... L93: try { L94: parsed = JSON.parse(raw); L95: } catch { ... L1270: }; L1271: function detectHostingPlatform(env = process.env) { L1272: for (const rule of RULES) { ... L1467: }, L1468: body: JSON.stringify({ L1469: grant_type: "client_credentials",

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L87

dist/refresh-manifest-PPV22Q2E.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.5.12 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.5.12 similarity = 0.963 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/refresh-manifest-PPV22Q2E.jsView on unpkg

Source & flagged code

5 flagged

dist/protect.edge.jsView file

Lines 1-26javascript

1var __create = Object.create;

2var __defProp = Object.defineProperty;

3var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

4var __getOwnPropNames = Object.getOwnPropertyNames;

5var __getProtoOf = Object.getPrototypeOf;

6var __hasOwnProp = Object.prototype.hasOwnProperty;

7var __commonJS = (cb, mod) => function __require() {

8 try {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/protect.edge.jsView on unpkg · L6

9 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

10 } catch (e) {

11 throw mod = 0, e;

12 }

13};

14var __copyProps = (to, from, except, desc) => {

15 if (from && typeof from === "object" || typeof from === "function") {

16 for (let key of __getOwnPropNames(from))

17 if (!__hasOwnProp.call(to, key) && key !== except)

18 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

19 }

20 return to;

21};

22var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

23 // If the importer is in node compatibility mode or this is not an ESM

24 // file that has been converted to a CommonJS file using a Babel-

25 // compatible transform (i.e. "__esModule" has not been set), then set

26 // "default" to the CommonJS "module.exports" for node compatibility.

Lines 264-304javascript

264 if (isSafeOrigin(candidate)) return candidate;

265 warnOnce(label, `[patchstack] ignoring unsafe ${label} override (${candidate}): must be https (or localhost). Using the default.`);

266 return fallback;

267}

268var warned = /* @__PURE__ */

dist/index.jsView file

Lines 8-48javascript

8 super(message);

9 this.code = code;

10 this.cause = cause;

11 this.name = "PatchstackError";

12 }

13 code;

dist/index.cjsView file

Lines 67-107javascript

67 super(message);

68 this.code = code;

69 this.cause = cause;

70 this.name = "PatchstackError";

71 }

72 code;

dist/refresh-manifest-PPV22Q2E.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @patchstack/connect@0.5.12 matchedIdentity = npm:QHBhdGNoc3RhY2svY29ubmVjdA:0.5.12 similarity = 0.963 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/refresh-manifest-PPV22Q2E.jsView on unpkg