@polderlabs/bizar@10.5.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@polderlabs/bizar@10.5.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

26 flagged · loading source

README.mdView file

•| **Prompt injection** | `ignore previous instructions`, `reveal your system prompt` |

High

Ai Reviewer Manipulation

Package text addresses the security reviewer or scanner and tries to influence the review outcome.

README.mdView on unpkg

bizar-dash/tests/memory-sync.test.mjsView file

107patternName = aws_access_key severity = critical line = 107 matchedText = body: 'A...ey',

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bizar-dash/tests/memory-sync.test.mjsView on unpkg · L107

107patternName = aws_access_key severity = critical line = 107 matchedText = body: 'A...ey',

Critical

Secret Pattern

AWS access key ID in bizar-dash/tests/memory-sync.test.mjs

bizar-dash/tests/memory-sync.test.mjsView on unpkg · L107

12import { mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from 'node:fs'; L13: import { execSync } from 'node:child_process'; L14:

High

Child Process

Package source references child process execution.

bizar-dash/tests/memory-sync.test.mjsView on unpkg · L12

bizar-dash/src/server/browser.mjsView file

18} else if (platform === 'win32') { L19: // Windows `start` is a shell builtin; spawn it via cmd.exe. L20: cmd = 'cmd';

High

Shell

Package source references shell execution.

bizar-dash/src/server/browser.mjsView on unpkg · L18

templates/plan/htmx.min.jsView file

1var htmx=function(){"use strict";const Q={onLoad:null,process:null,on:null,off:null,trigger:null,ajax:null,find:null,findAll:null,closest:null,values:function(e,t){const n=cn(e,t||...

Low

Eval

Package source references a known benign dynamic code generation pattern.

templates/plan/htmx.min.jsView on unpkg · L1

bizar-dash/tests/minimax-models.test.mjsView file

19const cacheBust = '?cb=' + Date.now() + '-' + Math.random().toString(36).slice(2); L20: mod = await import(join(REPO, 'bizar-dash/src/server/providers-store.mjs') + cacheBust); L21: AGENTS_DIR = join(REPO, 'config', 'agents');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bizar-dash/tests/minimax-models.test.mjsView on unpkg · L19

bizar-dash/src/server/bg-poller.mjsView file

32import { listClaudeMessages, readLastAssistantText } from './claude-info.mjs'; L33: import { execFileSync, spawn } from 'node:child_process'; L34: import { createHash } from 'node:crypto'; ... L165: status: newStatus, L166: metadata: { L167: ...(bg || {}), ... L294: return new Promise((resolve) => { L295: let stdout = ''; L296: let stderr = ''; ... L310: }, CC_TIMEOUT_MS); L311: proc.stdout.on('data', (c) => { stdout += c.toString('utf8'); }); L312: proc.stderr.on('data', (c) => { stderr += c.toString('utf8'); });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bizar-dash/src/server/bg-poller.mjsView on unpkg · L32

cli/service-controller.mjsView file

23* secrets come from a 0600 env file (`~/.config/bizar/service.env`). L24: * * All process spawning uses `spawnSync(command, args, {shell: false})` L25: * with explicit arg arrays. There is no string concatenation into a ... L45: const __filename = fileURLToPath(import.meta.url); L46: const __dirname = dirname(__filename); L47: const HOME = homedir(); ... L53: if (PLATFORM === 'win32') return null; L54: return process.env.XDG_CONFIG_HOME L55: ? join(process.env.XDG_CONFIG_HOME, 'systemd', 'user') ... L69: * Run an external command with explicit arg array. No shell. Strict 15s budget. L70: * Returns {status, stdout, stderr, error} where `status` is the exit code L71: * (or null on spawn failure) and `error` is a non-null Error object only when

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/service-controller.mjsView on unpkg · L23

bizar-dash/src/server/schedules-runner.mjsView file

18*/ L19: import { spawn } from 'node:child_process'; L20: import { writeFileSync, appendFileSync, mkdirSync } from 'node:fs'; ... L22: import { homedir } from 'node:os'; L23: import { isIP } from 'node:net'; L24: import { projectsStore } from './projects-store.mjs'; ... L30: const LOG_FILE = join(LOG_DIR, 'service.log'); L31: const ALLOW_PRIVATE_WEBHOOKS = process.env.BIZAR_DASHBOARD_ALLOW_PRIVATE_WEBHOOKS === '1'; L32: const SHELL_META = /[;&|`$<>\n\r]/;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bizar-dash/src/server/schedules-runner.mjsView on unpkg · L18

cli/install/postinstall.mjsView file

8import { existsSync, mkdirSync, copyFileSync } from 'node:fs'; L9: import { execSync } from 'node:child_process'; L10: import { join } from 'node:path'; ... L67: if (!hasUv) { L68: if (process.platform === 'win32') { L69: execSync('powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"', { stdio: 'pipe', timeout: 60000 }); L70: } else {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/install/postinstall.mjsView on unpkg · L8

bizar-dash/src/server/update-store.mjsView file

77try { L78: const output = execSync( L79: `npm install -g ${p.name}@latest --ignore-scripts`, L80: {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bizar-dash/src/server/update-store.mjsView on unpkg · L77

config/skills/embedded-esp-idf/scripts/size_check.shView file

•path = config/skills/embedded-esp-idf/scripts/size_check.sh kind = build_helper sizeBytes = 2452 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config/skills/embedded-esp-idf/scripts/size_check.shView on unpkg

package.jsonView file

•scripts changed=test:sdk,test:sdk:watch

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

bizar-dash/tests/memory-secrets.test.mjsView file

19patternName = aws_access_key severity = critical line = 19 matchedText = const re...E');

Critical

Secret Pattern

AWS access key ID in bizar-dash/tests/memory-secrets.test.mjs

bizar-dash/tests/memory-secrets.test.mjsView on unpkg · L19

25patternName = github_pat severity = critical line = 25 matchedText = const re...D');

Critical

Secret Pattern

GitHub personal access token in bizar-dash/tests/memory-secrets.test.mjs

bizar-dash/tests/memory-secrets.test.mjsView on unpkg · L25

31patternName = stripe_live_secret severity = critical line = 31 matchedText = const re...p');

Critical

Secret Pattern

Stripe live secret key in bizar-dash/tests/memory-secrets.test.mjs

bizar-dash/tests/memory-secrets.test.mjsView on unpkg · L31

37patternName = slack_bot_token severity = critical line = 37 matchedText = const re...x');

Critical

Secret Pattern

bizar-dash/tests/memory-store.test.mjsView file

223patternName = aws_access_key severity = critical line = 223 matchedText = body: 'A...ey',

Critical

Secret Pattern

AWS access key ID in bizar-dash/tests/memory-store.test.mjs

bizar-dash/tests/memory-store.test.mjsView on unpkg · L223

bizar-dash/tests/memory-cli.test.mjsView file

231patternName = aws_access_key severity = critical line = 231 matchedText = '--body'...ey',

Critical

Secret Pattern

AWS access key ID in bizar-dash/tests/memory-cli.test.mjs

bizar-dash/tests/memory-cli.test.mjsView on unpkg · L231

bizar-dash/scripts/smoke-bg-retry.mjsView file

45patternName = generic_password severity = medium line = 45 matchedText = const in...' };

Medium

Secret Pattern

Hardcoded password in bizar-dash/scripts/smoke-bg-retry.mjs

bizar-dash/scripts/smoke-bg-retry.mjsView on unpkg · L45

53patternName = generic_password severity = medium line = 53 matchedText = const in...' };

Medium

Secret Pattern

Hardcoded password in bizar-dash/scripts/smoke-bg-retry.mjs

bizar-dash/scripts/smoke-bg-retry.mjsView on unpkg · L53

65patternName = generic_password severity = medium line = 65 matchedText = password...st',

Medium

Secret Pattern

Hardcoded password in bizar-dash/scripts/smoke-bg-retry.mjs

bizar-dash/scripts/smoke-bg-retry.mjsView on unpkg · L65