@picsart/gen-ai@2.28.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@picsart/gen-ai@2.28.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

cli.jsView file

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)}

High

Child Process

Package source references child process execution.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersio

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

cli.jsView on unpkg · L1

10`).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in... L11: `);G.writeFileSync(e,r),spawn("cmd.exe",["/c",e],{detached:true,stdio:"ignore",windowsHide:true}).unref();}async function ju(){let t=await li(Pu);if(!t)return null;try{return JSON.... L12: `);}var zu="https://registry.npmjs.org/@picsart/gen-ai/latest",qu=`${process.env.GEN_AI_BASE_URL??"https://picsart.com/gen-ai-cli/releases"}/latest.txt`,Vu="update-check.json",Ku=1...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L10

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in... L11: `);G.wr

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in... L11: `);G.wr

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cli.jsView on unpkg · L1

Source & flagged code

8 flagged

cli.jsView file

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)}

High

Child Process

Package source references child process execution.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersio

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

cli.jsView on unpkg · L1

10`).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in... L11: `);G.writeFileSync(e,r),spawn("cmd.exe",["/c",e],{detached:true,stdio:"ignore",windowsHide:true}).unref();}async function ju(){let t=await li(Pu);if(!t)return null;try{return JSON.... L12: `);}var zu="https://registry.npmjs.org/@picsart/gen-ai/latest",qu=`${process.env.GEN_AI_BASE_URL??"https://picsart.com/gen-ai-cli/releases"}/latest.txt`,Vu="update-check.json",Ku=1...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L10

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in... L11: `);G.wr

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import fe,{Chalk}from'chalk';import*as G from'fs';import G__default,{readFileSync,writeFileSync,existsSync,mkdirSync,readdi... L2: `)} ... L6: `)} L7: `}let m=[c,u,...p],f=e.maxWidth??zo();return D(m,{color:o,padding:1,borderColor:e.borderColor,maxWidth:f})}function Pe(t){process.stdout.write(`${t} L8: `);}function mt(t){process.stderr.write(`${t} L9: `);}function Fu(t){let{color:e,quiet:r,debug:o,plainMode:n}=t;return {result(i){Pe(i);},info(i){if(r)return;let s=e.blue("i");mt(`${s} ${i}`);},success(i){if(r)return;let s=e.green... L10: `).find(m=>m.includes(`gen-ai-${n}${i}`))?.trim().split(/\s+/)[0];if(!d)return G.unlinkSync(a),{updated:false,oldVersion:t,newVersion:o,message:`Could not find checksum for ${n} in... L11: `);G.wr

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cli.jsView on unpkg · L1