@rainbow-robotics/muscat-plugin-kit@1.0.4: Suspicious npm | LPM Firewall

Loading npm security reports…

@rainbow-robotics/muscat-plugin-kit@1.0.4: Suspicious npm | LPM Firewall

Source & flagged code

9 flagged · loading source

cli/storybook-dist/assets/index-C1OzuK6-.jsView file

227patternName = generic_password severity = medium line = 227 matchedText = `+t),t},...{r}"

Medium

Secret Pattern

Package contains a possible secret pattern.

cli/storybook-dist/assets/index-C1OzuK6-.jsView on unpkg · L227

cli/storybook-dist/sb-manager/globals-runtime.jsView file

8464var l = parseInt("" + s[1], 10), u = parseInt("" + s[2], 10) / 100, c = parseInt("" + s[3], 10) / 100, p = "rgb(" + kp(l, u, c) + ")", h = _y. L8465: exec(p); L8466: if (!h)

High

Child Process

Package source references child process execution.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L8464

26849if (e !== "Object") { L26850: let t = new Function(`return function ${e.replace(/[^a-zA-Z0-9$_]+/g, "")}(){}`)(); L26851: Object.setPrototypeOf(value, new t());

Low

Eval

Package source references a known benign dynamic code generation pattern.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L26849

cli/src/uninstall.mjsView file

37const ps = `Start-Sleep -Milliseconds 500; Remove-Item -Force '${execPath}'`; L38: spawn("powershell", ["-NoProfile", "-Command", ps], { L39: detached: true,

High

Shell

Package source references shell execution.

cli/src/uninstall.mjsView on unpkg · L37

cli/storybook-dist/sb-addons/essentials-controls-2/manager-bundle.jsView file

1try{ L2: (()=>{var kp=Object.create;var Un=Object.defineProperty;var Rp=Object.getOwnPropertyDescriptor;var Op=Object.getOwnPropertyNames;var _p=Object.getPrototypeOf,Pp=Object.prototype.ha... L3: `+((E=s.meta.propertyIndent)!==null&&E!==void 0?E:""):"")+s.elements.map(f).join(s.meta.separator==="comma"?", ":s.meta.separator==="linebreak"?`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

cli/storybook-dist/sb-addons/essentials-controls-2/manager-bundle.jsView on unpkg · L1

cli/src/update.mjsView file

6// npm -g : globally installed Node.js package L7: // → npm install -g @rainbow-robotics/muscat-plugin-kit@<tag> L8: // local : plugin project's node_modules (fallback) ... L12: // and migrates the project structure if it's outdated (src/ → ui/, root main.py → py/). L13: import { execSync, spawn } from "node:child_process"; L14: import { chmodSync, copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/update.mjsView on unpkg · L6

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView file

•path = cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView on unpkg

cli/storybook-dist/nunito-sans-bold-italic.woff2View file

•path = cli/storybook-dist/nunito-sans-bold-italic.woff2 kind = high_entropy_blob sizeBytes = 49460 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/storybook-dist/nunito-sans-bold-italic.woff2View on unpkg

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView file

•path = cli/storybook-dist/assets/createGoalLayer-BTJsygfA.js kind = oversized_source_file sizeBytes = 2730249 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView on unpkg

Source & flagged code

9 flagged

cli/storybook-dist/assets/index-C1OzuK6-.jsView file

227patternName = generic_password severity = medium line = 227 matchedText = `+t),t},...{r}"

Medium

Secret Pattern

Package contains a possible secret pattern.

cli/storybook-dist/assets/index-C1OzuK6-.jsView on unpkg · L227

cli/storybook-dist/sb-manager/globals-runtime.jsView file

8464var l = parseInt("" + s[1], 10), u = parseInt("" + s[2], 10) / 100, c = parseInt("" + s[3], 10) / 100, p = "rgb(" + kp(l, u, c) + ")", h = _y. L8465: exec(p); L8466: if (!h)

High

Child Process

Package source references child process execution.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L8464

26849if (e !== "Object") { L26850: let t = new Function(`return function ${e.replace(/[^a-zA-Z0-9$_]+/g, "")}(){}`)(); L26851: Object.setPrototypeOf(value, new t());

Low

Eval

Package source references a known benign dynamic code generation pattern.

cli/storybook-dist/sb-manager/globals-runtime.jsView on unpkg · L26849

cli/src/uninstall.mjsView file

Lines 17-57javascript

17

18function isNpmGlobalInstall() {

19 try {

20 return isInside(realpathSync(kitRoot), realpathSync(npmGlobalRoot()));

21 } catch {

cli/storybook-dist/sb-addons/essentials-controls-2/manager-bundle.jsView file

Lines 1-21javascript

1try{

2(()=>{var kp=Object.create;var Un=Object.defineProperty;var Rp=Object.getOwnPropertyDescriptor;var Op=Object.getOwnPropertyNames;var _p=

cli/src/update.mjsView file

Lines 1-26javascript

1// muscat-pk update — update the CLI itself AND the plugin project's JS deps.

2//

3// Three install modes are handled:

4// binary : Bun self-contained binary downloaded from S3

5// → re-download from S3, replace process.execPath

6// npm -g : globally installed Node.js package

7// → npm install -g @rainbow-robotics/muscat-plugin-kit@<tag>

8// local : plugin project's node_modules (fallback)

9// → <pm> add @rainbow-robotics/muscat-plugin-kit@<tag>

10//

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView file

•path = cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.py kind = build_helper sizeBytes = 0

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

cli/templates/ros2/ros2_ws/src/__PLUGIN_SLUG__/__PLUGIN_SLUG__/__init__.pyView on unpkg

cli/storybook-dist/nunito-sans-bold-italic.woff2View file

•path = cli/storybook-dist/nunito-sans-bold-italic.woff2 kind = high_entropy_blob sizeBytes = 49460 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

cli/storybook-dist/nunito-sans-bold-italic.woff2View on unpkg

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView file

•path = cli/storybook-dist/assets/createGoalLayer-BTJsygfA.js kind = oversized_source_file sizeBytes = 2730249 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

cli/storybook-dist/assets/createGoalLayer-BTJsygfA.jsView on unpkg