Loading npm security reports…

@pisell/pisellos@2.2.308: Malicious npm security report (Block) | LPM Firewall

registry / @pisell/pisellos / 2.2.308

@pisell/pisellos@2.2.308

一个可扩展的前端模块化SDK框架，支持插件系统

AI Security Review

scanned 26d ago · by lpm-firewall-ai

When the ScanOrder module is initialized and its logger is available, it silently configures package-owned Feishu webhooks. It sends serialized runtime logging payloads, context, and extra data to those endpoints.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

A consumer initializes and uses the ScanOrder runtime.

Impact

Scan codes, customer-related identifiers, operational data, errors, and host context can be disclosed to the webhook owner.

Mechanism

Hard-coded remote logging of caller-supplied application data.

Attack narrative

Initializing ScanOrder selects Feishu logging and supplies hard-coded webhooks unless the caller overrides the logger configuration. ScanOrder methods place caller-provided data such as scan codes into log payloads. The logger serializes payload, extra fields, and context, and the provider posts them to the hard-coded endpoint. This is a concrete runtime data-exfiltration path, not an install-time action.

AI rationale

The package contains an active, default remote logging path to hard-coded third-party webhooks that transmits unconstrained application payloads. The lack of an install hook does not remove this runtime exfiltration behavior.

Evidence

dist/solution/ScanOrder/index.jsdist/modules/ScanOrderLogger/index.jsdist/modules/ScanOrderLogger/providers/feishu.js

Network endpoints2

open.feishu.cn/open-apis/bot/v2/hook/216b3fe6-af98-424e-8706-f0471241a7ed

Source & flagged code

5 flagged · loading source

dist/plugins/window.jsView file

•matchType = normalized_sha256 matchedPackage = @pisell/pisellos@0.10.53 matchedPath = dist/plugins/window.js matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:0.10.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugins/window.jsView on unpkg

248} else { L249: eval(handler); L250: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/window.jsView on unpkg · L248

dist/solution/ScanOrder/index.jsView file

•Default hardcoded logging webhook in dist/solution/ScanOrder/index.js: this.store.scanOrderLogger.setProviderConfig(((_this$otherParams5 = this.otherParams) === null || _this$otherParams5 === void 0 ? void 0 : _this$otherParams5.scanOrderLoggerConfig)... webhook: 'https://open.feishu.cn/open-apis/bot/v2/hook/216b3fe6-af98-424e-8706-f0471241a7ed', errorHook: 'https://open.feishu.cn/open-apis/bot/v2/hook/015b7c2a-dd3c-4c30-9898-ef0f5253111f' Rich runtime records posted to the webhook in [redacted].js: var context = record.context || {}; text: "\u65E5\u5FD7\u5185\u5BB9: ".concat(safeStringify(record.payload), "\n") text: "\u6269\u5C55\u4FE1\u606F: ".concat(safeStringify(record.extra), "\n") return fetch(webhook, { Reachable runtime logger calls in dist/modules/Order/index.js: this.logger.addL

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/solution/ScanOrder/index.jsView on unpkg

lib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1View on unpkg

lib/plugins/window.jsView file

•matchType = normalized_sha256 matchedPackage = @pisell/pisellos@0.10.53 matchedPath = lib/plugins/window.js matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:0.10.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/plugins/window.jsView on unpkg

Source & flagged code

5 flagged

dist/plugins/window.jsView file

Lines 228-268javascript

228 */

229var WindowPluginImpl = /*#__PURE__*/function () {

230 function WindowPluginImpl() {

231 _classCallCheck(this, WindowPluginImpl);

232 _defineProperty(this, "name", 'window');

233 _defineProperty(this, "version", '1.0.0');

234 // 定时器相关

235 _defineProperty(this, "setTimeout", Object.assign(function (handler, timeout) {

236 for (var _len = arguments.length, args = new Array(_len > 2 ? _len - 2 : 0), _key = 2; _key <

237 args[_key - 2] = arguments[_key];

238 }

239 if (typeof globalThis !== 'undefined' && globalThis.setTimeout) {

240 return globalThis.setTimeout.apply(globalThis, [handler, timeout].concat(args));

241 }

242 // Fallback 实现，使用 Promise 模拟

243 var timeoutId = Date.now();

244 Promise.resolve().then(function () {

245 setTimeout(function () {

246 if (typeof handler === 'function') {

247 handler.apply(void 0, args);

248 } else {

249 eval(handler);

250 }

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/plugins/window.jsView on unpkg · L248

251 }, timeout || 0);

252 });

253 return timeoutId;

254 }, {

255 __promisify__: function __promisify__(delay, value) {

256 return new Promise(function (resolve) {

257 return setTimeout(resolve, delay, value);

258 });

259 }

260 }));

261 _defineProperty(this, "clearTimeout", function (timeout) {

262 if (typeof globalThis !== 'undefined' && globalThis.clearTimeout) {

263 globalThis.clearTimeout(timeout);

264 }

265 // Fallback 不做任何操作

266 });

267 _defineProperty(this, "setInterval", Object.assign(function (handler, timeout) {

268 var _this = this;

•matchType = normalized_sha256 matchedPackage = @pisell/pisellos@0.10.53 matchedPath = dist/plugins/window.js matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:0.10.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugins/window.jsView on unpkg

dist/solution/ScanOrder/index.jsView file

•Default hardcoded logging webhook in dist/solution/ScanOrder/index.js: this.store.scanOrderLogger.setProviderConfig(((_this$otherParams5 = this.otherParams) === null || _this$otherParams5 === void 0 ? void 0 : _this$otherParams5.scanOrderLoggerConfig)... webhook: 'https://open.feishu.cn/open-apis/bot/v2/hook/216b3fe6-af98-424e-8706-f0471241a7ed', errorHook: 'https://open.feishu.cn/open-apis/bot/v2/hook/015b7c2a-dd3c-4c30-9898-ef0f5253111f' Rich runtime records posted to the webhook in [redacted].js: var context = record.context || {}; text: "\u65E5\u5FD7\u5185\u5BB9: ".concat(safeStringify(record.payload), "\n") text: "\u6269\u5C55\u4FE1\u606F: ".concat(safeStringify(record.extra), "\n") return fetch(webhook, { Reachable runtime logger calls in dist/modules/Order/index.js: this.logger.addL

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/solution/ScanOrder/index.jsView on unpkg

lib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/solution/RegisterAndLogin/utils.js#virtual:normalized:round1View on unpkg

lib/plugins/window.jsView file

•matchType = normalized_sha256 matchedPackage = @pisell/pisellos@0.10.53 matchedPath = lib/plugins/window.js matchedIdentity = npm:QHBpc2VsbC9waXNlbGxvcw:0.10.53 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/plugins/window.jsView on unpkg