Loading npm security reports…

@plutonhq/core-backend@0.1.40: Suspicious npm security report | LPM Firewall

registry / @plutonhq/core-backend / 0.1.40

@plutonhq/core-backend@0.1.40

Pluton Core Backend Library

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 250 file(s), 648 KB of source, external domains: 127.0.0.1, 192.168.1.106, 1fichier.com, api.github.com, api.hidrive.strato.com, app.koofr.net, archive.org, auth.api.rackspacecloud.com, auth.cloud.ovh.net, auth.storage.memset.com, authenticate.ain.net, ceph.endpoint.example.com, cloud.seafile.com, dl.usepluton.com, docs.aws.amazon.com, docs.oracle.com, example.com, graph.microsoft.com, help.dreamhost.com, identity.api.rackspacecloud.com, lon.auth.api.rackspacecloud.com, pixeldrain.com, play.min.io, pluton.b-cdn.net, proton.me, qingstor.com, s3.us.archive.org, sia.daemon.host, uloz.to, www.jottacloud.com, www.linkbox.to, www.premiumize.me, xxx.sharefile.com

Source & flagged code

5 flagged

dist/utils/cliPasswordReset.jsView file

Lines 1-1javascript

1import fs from"fs";import path from"path";import bcrypt from"bcryptjs";import{appPaths}from"./AppPaths";import{applyStrictPermissions}from"./envFileHelpers";import{prompt}from"./cliPrompt";export async function handlePasswordReset(){process.stdin.isTTY||process.exit(1);const userName=(await prompt("Enter new username (default: admin): ")).trim()||"admin",password1=await prompt("Enter new password: ",!0);password1||process.exit(1);password1!==await prompt("Confirm new password: ",!0)&&process.exit(1),await async function(userName,password){const hash=bcrypt.hashSync(password,10),keysPath=path.j ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/utils/cliPasswordReset.jsView on unpkg · L1

Long lines were clipped for display.

dist/managers/BaseSystemManager.jsView file

Lines 1-1javascript

1import os from"os";import{execSync}from"child_process";import{chmod,readFile,readdir,stat,mkdtemp,rm}from"fs/promises";import{createWriteStream}from"fs";import path from"path";import si

dist/utils/rclone/rclone.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @plutonhq/core-backend@0.1.39 matchedIdentity = npm:QHBsdXRvbmhxL2NvcmUtYmFja2VuZA:0.1.39 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/utils/rclone/rclone.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/utils/cliPasswordReset.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = import f...(0)}

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/utils/cliPasswordReset.jsView on unpkg · L1

dist/managers/BaseSystemManager.jsView file

1import os from"os";import{execSync}from"child_process";import{chmod,readFile,readdir,stat,mkdtemp,rm}from"fs/promises";import{createWriteStream}from"fs";import path from"path";impo...

High

Child Process

Package source references child process execution.

dist/managers/BaseSystemManager.jsView on unpkg · L1

1import os from"os";import{execSync}from"child_process";import{chmod,readFile,readdir,stat,mkdtemp,rm}from"fs/promises";import{createWriteStream}from"fs";import path from"path";impo...

High

Findings

4 High4 Medium5 Low

HighChild Processdist/managers/BaseSystemManager.js

HighShelldist/managers/BaseSystemManager.js

HighSame File Env Network Executiondist/managers/BaseSystemManager.js

HighPrevious Version Dangerous Deltadist/utils/rclone/rclone.js

MediumSecret Patterndist/utils/cliPasswordReset.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings