@picsart/gen-ai@2.59.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@picsart/gen-ai@2.59.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @picsart/gen-ai@2.31.4 matchedIdentity = npm:QHBpY3NhcnQvZ2VuLWFp:2.31.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("...

High

Child Process

Package source references child process execution.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(` ... L5: `)}function JT(e){e?process.env.DEBUG=e:delete process.env.DEBUG;}function YT(){return process.env.DEBUG}function XT(e){e.inspectOpts={};let t=Object.keys(me.inspectOpts);for(let r... L6: `).map(t=>t.trim()).join(" ")};Cy.O=function(e){return this.inspectOpts.colors=this.useColors,Bs.inspect(e,this.inspectOpts)};});var Ge=_((fie,gm)=>{type

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

cli.jsView on unpkg · L1

26`).find(o=>o.trim().endsWith(i))?.trim().split(/\s+/)[0]}async function aT(e,t){let i=(await nm(`${Is}/latest.txt`))?.trim();if(!i)return {updated:false,oldVersion:e,newVersion:e,m... L27: `);H.writeFileSync(t,r),spawn("cmd.exe",["/c",t],{detached:true,stdio:"ignore",windowsHide:true}).unref();}async function lT(){let e=await nm(eT);if(!e)return null;try{return JSON.... L28: `);}var pT="https://registry.npmjs.org/@picsart/gen-ai/latest",mT=`${process.env.GEN_AI_BASE_URL??"https://picsart.com/gen-ai-cli/releases"}/latest.txt`,fT="update-check.json",gT=1...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L26

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(` ... L5: `)}function JT(e){e?process.env.DEBUG=e:delete process.env.DEBUG;}function YT(){return process.env.DEBUG}function XT(e){e.inspectOpts={};let t=Object.keys(me.inspectOpts);for(let r... L6: `).map(t=>t.trim()).join(" ")};Cy.O=function(e){return this.inspectOpts.colors=this.useColors,Bs.inspect(e,this.inspectOpts)};});var Ge=_((fie,gm)=>{typeof process>"u"||process.typ... L7: `).join(`\r ... L11: \r L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(` ... L5: `)}function JT(e){e?process.env.DEBUG=e:delete process.env.DEBUG;}function YT(){return process.env.DEBUG}function XT(e){e.inspectOpts={};let t=Object.keys(me.inspectOpts);for(let r... L6: `).map(t=>t.trim()).join(" ")};Cy.O=function(e){return this.inspectOpts.colors=this.useColors,Bs.inspect(e,this.inspectOpts)};});var Ge=_((fie,gm)=>{typeof process>"u"||process.typ... L7: `).join(`\r ... L11: \r L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cli.jsView on unpkg · L1

Source & flagged code

10 flagged

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @picsart/gen-ai@2.31.4 matchedIdentity = npm:QHBpY3NhcnQvZ2VuLWFp:2.31.4 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("...

High

Child Process

Package source references child process execution.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

cli.jsView on unpkg · L1

1Trigger-reachable persistence chain: manifest.main -> cli.js L1: import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(` ... L5: `)}function JT(e){e?process.env.DEBUG=e:delete process.env.DEBUG;}function YT(){return process.env.DEBUG}function XT(e){e.inspectOpts={};let t=Object.keys(me.inspectOpts);for(let r... L6: `).map(t=>t.trim()).join(" ")};Cy.O=function(e){return this.inspectOpts.colors=this.useColors,Bs.inspect(e,this.inspectOpts)};});var Ge=_((fie,gm)=>{type

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

cli.jsView on unpkg · L1

26`).find(o=>o.trim().endsWith(i))?.trim().split(/\s+/)[0]}async function aT(e,t){let i=(await nm(`${Is}/latest.txt`))?.trim();if(!i)return {updated:false,oldVersion:e,newVersion:e,m... L27: `);H.writeFileSync(t,r),spawn("cmd.exe",["/c",t],{detached:true,stdio:"ignore",windowsHide:true}).unref();}async function lT(){let e=await nm(eT);if(!e)return null;try{return JSON.... L28: `);}var pT="https://registry.npmjs.org/@picsart/gen-ai/latest",mT=`${process.env.GEN_AI_BASE_URL??"https://picsart.com/gen-ai-cli/releases"}/latest.txt`,fT="update-check.json",gT=1...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.jsView on unpkg · L26

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(` ... L5: `)}function JT(e){e?process.env.DEBUG=e:delete process.env.DEBUG;}function YT(){return process.env.DEBUG}function XT(e){e.inspectOpts={};let t=Object.keys(me.inspectOpts);for(let r... L6: `).map(t=>t.trim()).join(" ")};Cy.O=function(e){return this.inspectOpts.colors=this.useColors,Bs.inspect(e,this.inspectOpts)};});var Ge=_((fie,gm)=>{typeof process>"u"||process.typ... L7: `).join(`\r ... L11: \r L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli.jsView on unpkg · L1

1import {Flags,Args,Command,run,execute}from'@oclif/core';import Je,{Chalk}from'chalk';import*as H from'fs';import H__default,{readFileSync,existsSync,mkdirSync,readdirSync,cpSync}f... L2: `);return S.substr(0,S.length-2)},this.getRequestHeader=function(S){return typeof S=="string"&&d[S]?d[S]:""},this.send=function(S){if(this.readyState!=this.OPENED)throw new Error("... L3: `).join(` ... L5: `)}function JT(e){e?process.env.DEBUG=e:delete process.env.DEBUG;}function YT(){return process.env.DEBUG}function XT(e){e.inspectOpts={};let t=Object.keys(me.inspectOpts);for(let r... L6: `).map(t=>t.trim()).join(" ")};Cy.O=function(e){return this.inspectOpts.colors=this.useColors,Bs.inspect(e,this.inspectOpts)};});var Ge=_((fie,gm)=>{typeof process>"u"||process.typ... L7: `).join(`\r ... L11: \r L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

cli.jsView on unpkg · L1