@quanthermes/hermes-web-ui@0.6.33: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@quanthermes/hermes-web-ui@0.6.33: Suspicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/client/assets/js/index-BpXQoZjJ.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @quanthermes/hermes-web-ui@0.6.32 matchedIdentity = npm:[redacted]:0.6.32 similarity = 0.385 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/client/assets/js/index-BpXQoZjJ.jsView on unpkg

1patternName = generic_password severity = medium line = 1 matchedText = import{a...in(`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/js/index-BpXQoZjJ.jsView on unpkg · L1

bin/hermes-web-ui.mjsView file

1Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L1: #!/usr/bin/env node L2: import { spawn, execSync, execFileSync } from 'child_process' L3: import { resolve, dirname, join, delimiter } from 'path' ... L8: L9: const __dirname = dirname(fileURLToPath(import.meta.url)) L10: const __filename = fileURLToPath(import.meta.url) ... L12: const pkgDir = resolve(__dirname, '..') L13: const pkg = JSON.parse(readFileSync(resolve(pkgDir, 'package.json'), 'utf-8')) L14: const PACKAGE_NAME = pkg.name || 'hermes-web-ui' L15: const VERSION = pkg.version L16: const WEB_UI_HOME = process.env.HERMES_WEB_UI_HOME?.trim() L17: ? resolve(process.env.HERMES_WEB_UI_HOME.trim())

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/hermes-web-ui.mjsView on unpkg · L1

dist/server/agent-bridge/python/bridge_transport.pyView file

•path = dist/server/agent-bridge/python/bridge_transport.py kind = build_helper sizeBytes = 12814 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/agent-bridge/python/bridge_transport.pyView on unpkg

dist/client/favicon.icoView file

•path = dist/client/favicon.ico kind = high_entropy_blob sizeBytes = 685596 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/favicon.icoView on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 8099860 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg

Source & flagged code

6 flagged

dist/client/assets/js/index-BpXQoZjJ.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @quanthermes/hermes-web-ui@0.6.32 matchedIdentity = npm:[redacted]:0.6.32 similarity = 0.385 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/client/assets/js/index-BpXQoZjJ.jsView on unpkg

1patternName = generic_password severity = medium line = 1 matchedText = import{a...in(`

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/client/assets/js/index-BpXQoZjJ.jsView on unpkg · L1

bin/hermes-web-ui.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn, execSync, execFileSync } from 'child_process'

3import { resolve, dirname, join, delimiter } from 'path'

4import { fileURLToPath } from 'url'

5import { readFileSync, writeFileSync, unlinkSync, mkdirSync, openSync, chmodSync, statSync, existsSync, realpathSync } from 'fs'

6import { randomBytes, scryptSync } from 'crypto'

7import { homedir } from 'os'

8

9const __dirname = dirname(fileURLToPath(import.meta.url))

10const __filename = fileURLToPath(import.meta.url)

11const serverEntry = resolve(__dirname, '..', 'dist', 'server', 'index.js')

12const pkgDir = resolve(__dirname, '..')

13const pkg = JSON.parse(readFileSync(resolve(pkgDir, 'package.json'), 'utf-8'))

14const PACKAGE_NAME = pkg.name || 'hermes-web-ui'

15const VERSION = pkg.version

16const WEB_UI_HOME = process.env.HERMES_WEB_UI_HOME?.trim()

17 ? resolve(process.env.HERMES_WEB_UI_HOME.trim())

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/hermes-web-ui.mjsView on unpkg · L1

18 : resolve(homedir(), '.hermes-web-ui')

19const PID_DIR = WEB_UI_HOME

20const PID_FILE = join(PID_DIR, 'server.pid')

21const LOG_FILE = join(PID_DIR, 'server.log')

dist/server/agent-bridge/python/bridge_transport.pyView file

•path = dist/server/agent-bridge/python/bridge_transport.py kind = build_helper sizeBytes = 12814 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/server/agent-bridge/python/bridge_transport.pyView on unpkg

dist/client/favicon.icoView file

•path = dist/client/favicon.ico kind = high_entropy_blob sizeBytes = 685596 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/favicon.icoView on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 8099860 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg