Loading npm security reports…

@plutonhq/core-backend@0.1.39: Suspicious npm security report | LPM Firewall

registry / @plutonhq/core-backend / 0.1.39

@plutonhq/core-backend@0.1.39

Pluton Core Backend Library

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 239 file(s), 615 KB of source, external domains: 127.0.0.1, 192.168.1.106, 1fichier.com, api.github.com, api.hidrive.strato.com, app.koofr.net, archive.org, auth.api.rackspacecloud.com, auth.cloud.ovh.net, auth.storage.memset.com, authenticate.ain.net, ceph.endpoint.example.com, cloud.seafile.com, dl.usepluton.com, docs.aws.amazon.com, docs.oracle.com, example.com, graph.microsoft.com, help.dreamhost.com, identity.api.rackspacecloud.com, lon.auth.api.rackspacecloud.com, pixeldrain.com, play.min.io, pluton.b-cdn.net, proton.me, qingstor.com, s3.us.archive.org, sia.daemon.host, uloz.to, www.jottacloud.com, www.linkbox.to, www.premiumize.me, xxx.sharefile.com

Source & flagged code

4 flagged

dist/utils/cliPasswordReset.jsView file

Lines 1-1javascript

1import readline from"readline";import fs from"fs";import path from"path";import bcrypt from"bcryptjs";import{appPaths}from"./AppPaths";import{applyStrictPermissions}from"./envFileHelpers";function prompt(question,hidden=!1){return new Promise(resolve=>{if(hidden){process.stdout.write(question);const rl=readline.createInterface({input:process.stdin,output:new(require("stream").Writable)({write(_chunk,_encoding,callback){callback()}}),terminal:!0});rl.question("",answer=>{rl.close(),process.stdout.write("\n"),resolve(answer)})}else{const rl=readline.createInterface({input:process.stdin,output:pr ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/utils/cliPasswordReset.jsView on unpkg · L1

Long lines were clipped for display.

dist/managers/BaseSystemManager.jsView file

Lines 1-1javascript

1import os from"os";import{execSync}from"child_process";import{chmod,readFile,readdir,stat,mkdtemp,rm}from"fs/promises";import{createWriteStream}from"fs";import path from"path";import si

Source & flagged code

4 flagged · loading source

dist/utils/cliPasswordReset.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import r...(0)}

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/utils/cliPasswordReset.jsView on unpkg · L1

dist/managers/BaseSystemManager.jsView file

1import os from"os";import{execSync}from"child_process";import{chmod,readFile,readdir,stat,mkdtemp,rm}from"fs/promises";import{createWriteStream}from"fs";import path from"path";impo...

High

Child Process

Package source references child process execution.

dist/managers/BaseSystemManager.jsView on unpkg · L1

1import os from"os";import{execSync}from"child_process";import{chmod,readFile,readdir,stat,mkdtemp,rm}from"fs/promises";import{createWriteStream}from"fs";import path from"path";impo...

High

Findings

3 High4 Medium5 Low

HighChild Processdist/managers/BaseSystemManager.js

HighShelldist/managers/BaseSystemManager.js

HighSame File Env Network Executiondist/managers/BaseSystemManager.js

MediumSecret Patterndist/utils/cliPasswordReset.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings