@quanthermes/hermes-web-ui: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@quanthermes/hermes-web-ui: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/client/assets/js/en-BBep0TR-.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/js/en-BBep0TR-.jsView on unpkg · L1

bin/hermes-web-ui.mjsView file

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L1: #!/usr/bin/env node L2: import { spawn, execSync, execFileSync } from 'child_process' L3: import { resolve, dirname, join, delimiter } from 'path' ... L8: L9: const __dirname = dirname(fileURLToPath(import.meta.url)) L10: const __filename = fileURLToPath(import.meta.url) ... L12: const pkgDir = resolve(__dirname, '..') L13: const pkg = JSON.parse(readFileSync(resolve(pkgDir, 'package.json'), 'utf-8')) L14: const PACKAGE_NAME = pkg.name || 'hermes-web-ui' L15: const VERSION = pkg.version L16: const WEB_UI_HOME = process.env.HERMES_WEB_UI_HOME?.trim() L17: ? resolve(process.env.HERMES_WEB_UI_HOME.trim())

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/hermes-web-ui.mjsView on unpkg · L1

dist/server/agent-bridge/python/bridge_transport.pyView file

•path = dist/server/agent-bridge/python/bridge_transport.py kind = build_helper sizeBytes = 13367 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/agent-bridge/python/bridge_transport.pyView on unpkg

dist/client/favicon.icoView file

•path = dist/client/favicon.ico kind = high_entropy_blob sizeBytes = 685596 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/favicon.icoView on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 8294816 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg

dist/client/assets/js/fr-CGJaM7NN.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/fr-CGJaM7NN.js

dist/client/assets/js/fr-CGJaM7NN.jsView on unpkg · L1

dist/client/assets/js/ru-BozCGcLl.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/ru-BozCGcLl.js

dist/client/assets/js/ru-BozCGcLl.jsView on unpkg · L1

dist/client/assets/js/ja-Chr9mUtG.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/ja-Chr9mUtG.js

dist/client/assets/js/ja-Chr9mUtG.jsView on unpkg · L1

dist/client/assets/js/es-DWjwtRju.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/es-DWjwtRju.js

dist/client/assets/js/es-DWjwtRju.jsView on unpkg · L1

dist/client/assets/js/pt-BPH7W-cM.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/pt-BPH7W-cM.js

dist/client/assets/js/pt-BPH7W-cM.jsView on unpkg · L1

dist/client/assets/js/de-DDnKKL4R.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/de-DDnKKL4R.js

dist/client/assets/js/de-DDnKKL4R.jsView on unpkg · L1

dist/client/assets/js/ko-Cc4l8vBD.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/ko-Cc4l8vBD.js

dist/client/assets/js/ko-Cc4l8vBD.jsView on unpkg · L1

Source & flagged code

12 flagged

dist/client/assets/js/en-BBep0TR-.jsView file

Lines 1-2javascript

1var e={login:{title:"Quanta Hermes",description:"Enter your access token to continue. Find it in the server startup logs.",placeholder:"Access token",submit:"Login",tokenRequired:"Please enter your access token",invalidToken:"Invalid token",connectionFailed:"Cannot connect to server",passwordLogin:"Password",tokenLogin:"Token",usernamePlaceholder:"Username",passwordPlaceholder:"Password",defaultCredentialsHint:"Default username: quanthermes. Default password: 12345678. Change them after the first sign-in.",credentialsRequired:"Please enter username and password",invalidCredentials:"Invalid use ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/js/en-BBep0TR-.jsView on unpkg · L1

2

Long lines were clipped for display.

bin/hermes-web-ui.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn, execSync, execFileSync } from 'child_process'

3import { resolve, dirname, join, delimiter } from 'path'

4import { fileURLToPath } from 'url'

5import { readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, chmodSync, statSync, existsSync, realpathSync } from 'fs'

dist/server/agent-bridge/python/bridge_transport.pyView file

•path = dist/server/agent-bridge/python/bridge_transport.py kind = build_helper sizeBytes = 13367 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/agent-bridge/python/bridge_transport.pyView on unpkg

dist/client/favicon.icoView file

•path = dist/client/favicon.ico kind = high_entropy_blob sizeBytes = 685596 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/favicon.icoView on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 8294816 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg

dist/client/assets/js/fr-CGJaM7NN.jsView file

Lines 1-2javascript

1var e={login:{title:"QuantHermes Web UI",description:"Entrez votre jeton d'acces pour continuer. Retrouvez-le dans les journaux de demarrage du serveur.",placeholder:"Jeton d'acces",submit:"Connexion",tokenRequired:"Veuillez entrer votre jeton d'acces",invalidToken:"Jeton invalide",connectionFailed:"Impossible de se connecter au serveur",passwordLogin:"Mot de passe",tokenLogin:"Jeton",usernamePlaceholder:"Nom d'utilisateur",passwordPlaceholder:

dist/client/assets/js/ru-BozCGcLl.jsView file

Lines 1-2javascript

1var e={login:{title:"Hermes Studio",description:"Введите имя пользователя и пароль для продолжения.",placeholder:"Токен доступа",submit:"Войти",tokenRequired:"Введите токен доступа",invalidToken:"Недействительный токен",connectionFailed:"Не удалось подключиться к серверу",passwordLogin:"Вход по паролю",tokenLogin:"Вход по токену",usernamePlaceholder:"Имя пользователя",passwordPlaceholder:"Пароль"

dist/client/assets/js/ja-Chr9mUtG.jsView file

Lines 1-2javascript

1var e={login:{title:"QuantHermes Web UI",description:"アクセストークンを入力して続行してください。サーバーの起動ログで確認できます。",placeholder:"アクセストークン",submit:"ログイン",tokenRequired:"アクセストークンを入力してください",invalidToken:"無効なトークンです",connectionFailed:"サーバーに接続できません",passwordLogin:"パスワード",tokenLogin:"トークン",usernamePlaceholder:"ユーザー名",passwordPlaceholder:"パスワード",defaultCredentialsHint:

dist/client/assets/js/es-DWjwtRju.jsView file

Lines 1-2javascript

1var e={login:{title:"QuantHermes Web UI",description:"Introduce tu token de acceso para continuar. Encuentralo en los registros de inicio del servidor.",placeholder:"Token de acceso",submit:"Iniciar sesion",tokenRequired:"Por favor, introduce tu token de acceso",invalidToken:"Token invalido",connectionFailed:"No se puede conectar al servidor",passwordLogin:"Contrasena",tokenLogin:"Token",usernamePlaceholder:"Nombre de usuario",passwordPlaceholder:

dist/client/assets/js/pt-BPH7W-cM.jsView file

Lines 1-2javascript

1var e={login:{title:"QuantHermes Web UI",description:"Insira seu token de acesso para continuar. Encontre-o nos logs de inicializacao do servidor.",placeholder:"Token de acesso",submit:"Entrar",tokenRequired:"Por favor, insira seu token de acesso",invalidToken:"Token invalido",connectionFailed:"Nao foi possivel conectar ao servidor",passwordLogin:"Senha",tokenLogin:"Token",usernamePlaceholder:"Nome de usuario",passwordPlaceholder:

dist/client/assets/js/de-DDnKKL4R.jsView file

Lines 1-2javascript

1var e={login:{title:"QuantHermes Web UI",description:"Geben Sie Ihren Zugangs-Token ein, um fortzufahren. Finden Sie ihn in den Server-Startprotokollen.",placeholder:"Zugangs-Token",submit:"Anmelden",tokenRequired:"Bitte geben Sie Ihren Zugangs-Token ein",invalidToken:"Ungultiger Token",connectionFailed:"Verbindung zum Server nicht moglich",passwordLogin:"Passwort",tokenLogin:"Token",usernamePlaceholder:"Benutzername",passwordPlaceholder:

dist/client/assets/js/ko-Cc4l8vBD.jsView file

1patternName = generic_password severity = medium line = 1 matchedText = var e={l...lt};

Medium

Secret Pattern

Hardcoded password in dist/client/assets/js/ko-Cc4l8vBD.js

dist/client/assets/js/ko-Cc4l8vBD.jsView on unpkg · L1