@realtek/core-theme@0.0.134: Suspicious npm security report

Loading npm security reports…

@realtek/core-theme@0.0.134: Suspicious npm security report | LPM Firewall

Source & flagged code

3 flagged

package.jsonView file

Lines 24-64json

24 "files": [

25 "dist-lib",

26 "scripts/init-admin-mongodb.js"

27 ],

28 "sideEffects": [

29 "**/*.css"

30 ],

31 "publishConfig": {

32 "access": "public",

33 "registry": "https://registry.npmjs.org/"

34 },

35 "scripts": {

36 "install:hooks": "node scripts/install-git-hooks.js",

37 "setup": "npm ci && npm run install:hooks",

38 "predev": "node scripts/install-git-hooks.js",

39 "dev": "vite",

40 "pretest": "node scripts/install-git-hooks.js",

41 "build": "vite build",

42 "prebuild": "node scripts/install-git-hooks.js",

43 "build:lib": "vite build --config vite.lib.config.js",

44 "postinstall": "node scripts/init-admin-mongodb.js --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "init:mongodb": "node scripts/init-admin-mongodb.js",

46 "check:publish": "node -e \"const p=require('./package.json');const s=p.scripts||{};const bad=['preinstall','install','prepare'].filter(k=>s[k]);if(bad.length){console.error('Refusing to publish '+p.name+': remove package lifecycle script(s): '+bad.join(', '));process.exit(1)}const expectedPostinstall='node scripts/init-admin-mongodb.js --postinstall';if(s.postinstall!==expectedPostinstall){console.error('Refusing to publish '+p.name+': postinstall must be '+JSON.stringify(expectedPostinstall)+'.');process.exit(1)}const expected=['dist-lib','scripts/init-admin-mongodb.js'];if(!Array.isArra ...

47 "prepublishOnly": "npm run check:publish && npm run build:lib",

48 "lint": "eslint .",

49 "preview": "vite preview",

50 "test": "vitest run",

51 "test:dashboard": "node scripts/run-test-dashboard.js src/testcomponent",

52 "test:dashboard:addform": "node scripts/run-test-dashboard.js src/testcomponent/AddFormTestComponent",

53 "test:dashboard:listview": "node scripts/run-test-dashboard.js src/testcomponent/ListViewTestComponent",

54 "test:dashboard:detailview": "node scripts/run-test-dashboard.js src/testcomponent/DetailViewTestComponent",

55 "test:dashboard:editform": "node scripts/run-test-dashboard.js src/testcomponent/EditFormTestComponent",

56 "test:changed-components": "node scripts/run-changed-component-tests.js",

57 "pr:test": "node scripts/run-pr-component-tests.js",

58 "pr:create": "node scripts/create-pr-with-component-tests.js",

59 "test:addform": "vitest run src/testcomponent/AddFormTestComponent",

60 "test:addform:unit": "vitest run src/testcomponent/AddFormTestComponent/unit",

61 "test:addform:integration": "vitest run src/testcomponent/AddFormTestComponent/integration",

62 "test:addform:list": "vitest list src/testcomponent/AddFormTestComponent",

63 "test:editform": "vitest run src/testcomponent/EditFormTestComponent",

64 "test:editform:unit": "vitest run src/testcomponent/EditFormTestComponent/unit",

Long lines were clipped for display.

dist-lib/index.jsView file

•path = dist-lib/index.js kind = oversized_source_file sizeBytes = 2812725 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/init-admin-mongodb.js --postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/init-admin-mongodb.js --postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-lib/index.jsView file

•path = dist-lib/index.js kind = oversized_source_file sizeBytes = 2812725 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/index.jsView on unpkg

Source & flagged code

3 flagged

package.jsonView file

Lines 24-64json

24 "files": [

25 "dist-lib",

26 "scripts/init-admin-mongodb.js"

27 ],

28 "sideEffects": [

29 "**/*.css"

30 ],

31 "publishConfig": {

32 "access": "public",

33 "registry": "https://registry.npmjs.org/"

34 },

35 "scripts": {

36 "install:hooks": "node scripts/install-git-hooks.js",

37 "setup": "npm ci && npm run install:hooks",

38 "predev": "node scripts/install-git-hooks.js",

39 "dev": "vite",

40 "pretest": "node scripts/install-git-hooks.js",

41 "build": "vite build",

42 "prebuild": "node scripts/install-git-hooks.js",

43 "build:lib": "vite build --config vite.lib.config.js",

44 "postinstall": "node scripts/init-admin-mongodb.js --postinstall",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L44

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L44

45 "init:mongodb": "node scripts/init-admin-mongodb.js",

47 "prepublishOnly": "npm run check:publish && npm run build:lib",

48 "lint": "eslint .",

49 "preview": "vite preview",

50 "test": "vitest run",

51 "test:dashboard": "node scripts/run-test-dashboard.js src/testcomponent",

52 "test:dashboard:addform": "node scripts/run-test-dashboard.js src/testcomponent/AddFormTestComponent",

53 "test:dashboard:listview": "node scripts/run-test-dashboard.js src/testcomponent/ListViewTestComponent",

54 "test:dashboard:detailview": "node scripts/run-test-dashboard.js src/testcomponent/DetailViewTestComponent",

55 "test:dashboard:editform": "node scripts/run-test-dashboard.js src/testcomponent/EditFormTestComponent",

56 "test:changed-components": "node scripts/run-changed-component-tests.js",

57 "pr:test": "node scripts/run-pr-component-tests.js",

58 "pr:create": "node scripts/create-pr-with-component-tests.js",

59 "test:addform": "vitest run src/testcomponent/AddFormTestComponent",

60 "test:addform:unit": "vitest run src/testcomponent/AddFormTestComponent/unit",

61 "test:addform:integration": "vitest run src/testcomponent/AddFormTestComponent/integration",

62 "test:addform:list": "vitest list src/testcomponent/AddFormTestComponent",

63 "test:editform": "vitest run src/testcomponent/EditFormTestComponent",

64 "test:editform:unit": "vitest run src/testcomponent/EditFormTestComponent/unit",

Long lines were clipped for display.

dist-lib/index.jsView file

•path = dist-lib/index.js kind = oversized_source_file sizeBytes = 2812725 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/index.jsView on unpkg

@realtek/core-theme@0.0.134

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code