@redocly/cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@redocly/cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

lib/chunks/HT6ZGKQQ.jsView file

23557patternName = generic_password severity = medium line = 23557 matchedText = password...ow",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunks/HT6ZGKQQ.jsView on unpkg · L23557

25829patternName = generic_password severity = medium line = 25829 matchedText = password...ow",

Medium

Secret Pattern

Hardcoded password in lib/chunks/HT6ZGKQQ.js

lib/chunks/HT6ZGKQQ.jsView on unpkg · L25829

lib/index.jsView file

7645// src/commands/eject.ts L7646: import { spawn } from "node:child_process"; L7647:

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L7645

62Cross-file remote execution chain: lib/index.js spawns lib/chunks/BFQ3EROY.js; helper contains network access plus dynamic code execution. L62: import { L63: require_undici L64: } from "./chunks/XB6C62FW.js"; ... L165: "use strict"; L166: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ... L167: }; ... L2123: L2124: // ../../node_modules/dotenv/package.json L2125: var require_package = __commonJS({ ... L2223: if (!result.parsed) { L2224: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L2225: err.code = "MISSING_DATA";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/index.jsView on unpkg · L62

2import { createRequire as __createRequire } from 'node:module'; L3: const require = __createRequire(import.meta.url); L4: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/index.jsView on unpkg · L2

62import { L63: require_undici L64: } from "./chunks/XB6C62FW.js"; ... L165: "use strict"; L166: var debug = typeof process === "object" && process.env && process.env.NODE_DEBUG && /\bsemver\b/i.test(process.env.NODE_DEBUG) ? (...args) => console.error("SEMVER", ...args) : () ... L167: }; ... L2123: L2124: // ../../node_modules/dotenv/package.json L2125: var require_package = __commonJS({ ... L2223: if (!result.parsed) { L2224: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`); L2225: err.code = "MISSING_DATA";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/index.jsView on unpkg · L62

lib/chunks/73MCRGNI.jsView file

19891printDepTree(getDependencyTree(derivation), lines, 1); L19892: new Function("debugger;\n/*\nTracing '" + derivation.name_ + "'\n\nYou are entering this break point because derivation '" + derivation.name_ + "' is being traced and '" + observab... L19893: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chunks/73MCRGNI.jsView on unpkg · L19891

1081score, L1082: matchData: matchingFields[fieldRef] L1083: }; ... L1458: char = this.next(); L1459: charCode = char.charCodeAt(0); L1460: } while (charCode > 47 && charCode < 58); ... L7551: *next(token) { L7552: if (node_process.env.LOG_STREAM) L7553: console.dir(token, { depth: null }); ... L10274: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L10275: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L10276: displayName

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/chunks/73MCRGNI.jsView on unpkg · L1081

lib/chunks/PVILCIEK.jsView file

84// src/auth/device-flow.ts L85: import * as childProcess from "node:child_process"; L86: L87: // src/utils/fetch-with-timeout.ts L88: var import_undici = __toESM(require_undici(), 1); L89: ... L92: function getProxyUrl() { L93: return process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.http_proxy || process.env.https_proxy; L94: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/chunks/PVILCIEK.jsView on unpkg · L84

lib/chunks/RD4BYLLT.jsView file

•path = lib/chunks/RD4BYLLT.js kind = oversized_source_file sizeBytes = 4412487 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/chunks/RD4BYLLT.jsView on unpkg

lib/chunks/NRZEGU6G.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @redocly/cli@2.39.0 matchedIdentity = npm:QHJlZG9jbHkvY2xp:2.39.0 similarity = 0.793 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chunks/NRZEGU6G.jsView on unpkg

Source & flagged code

11 flagged

lib/chunks/HT6ZGKQQ.jsView file

23557patternName = generic_password severity = medium line = 23557 matchedText = password...ow",

Medium

Secret Pattern

Package contains a possible secret pattern.

lib/chunks/HT6ZGKQQ.jsView on unpkg · L23557

25829patternName = generic_password severity = medium line = 25829 matchedText = password...ow",

Medium

Secret Pattern

Hardcoded password in lib/chunks/HT6ZGKQQ.js

lib/chunks/HT6ZGKQQ.jsView on unpkg · L25829

lib/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __createRequire } from 'node:module';

3const require = __createRequire(import.meta.url);

4import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/index.jsView on unpkg · L2

5 E,

6 ulid

7} from "./chunks/ICPYP2LP.js";

8import {

9 capitalize,

10 cleanColors,

11 dumpBundle,

12 escapeLanguageName,

13 formatPath,

14 getAliasOrPath,

15 getAndValidateFileExtension,

16 getExecutionTime,

17 getFallbackApisOrExit,

18 getOutputFileName,

19 handleError,

20 handleLint,

21 langToExt,

22 loadConfigAndHandleErrors,

Lines 42-82javascript

42 RedoclyOAuthClient,

43 ReuniteApi,

44 ReuniteApiError,

45 fetch_with_timeout_default,

46 getDomain,

47 getProxyUrl,

48 getReuniteUrl,

49 shouldBypassProxy

50} from "./chunks/PVILCIEK.js";

51import {

52 ANONYMOUS_ID_CACHE_FILE,

53 DEFAULT_FETCH_TIMEOUT,

Lines 7625-7665javascript

7625 outputFile || "stdout"

7626 )} ${green(elapsed)}.

7627`

7628 );

7629 }

7630 const removedCount = meta.visitorsData?.["remove-unused-components"]?.removedCount;

7631 if (removedCount) {

7632 logger.info(gray(`\u{1F9F9} Removed ${removedCount} unused components.

7633`));

lib/chunks/73MCRGNI.jsView file

19891printDepTree(getDependencyTree(derivation), lines, 1); L19892: new Function("debugger;\n/*\nTracing '" + derivation.name_ + "'\n\nYou are entering this break point because derivation '" + derivation.name_ + "' is being traced and '" + observab... L19893: }

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/chunks/73MCRGNI.jsView on unpkg · L19891

1081score, L1082: matchData: matchingFields[fieldRef] L1083: }; ... L1458: char = this.next(); L1459: charCode = char.charCodeAt(0); L1460: } while (charCode > 47 && charCode < 58); ... L7551: *next(token) { L7552: if (node_process.env.LOG_STREAM) L7553: console.dir(token, { depth: null }); ... L10274: specialPropKeyWarningShown || (specialPropKeyWarningShown = true, console.error( L10275: "%s: `key` is not a prop. Trying to access it will result in `undefined` being returned. If you need to access the same value within the child component, you should pass it as a di... L10276: displayName

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/chunks/73MCRGNI.jsView on unpkg · L1081

lib/chunks/PVILCIEK.jsView file

Lines 64-104javascript

64 return true;

65}

66function withHttpsValidation(fn) {

67 return (...args) => {

68 const

lib/chunks/RD4BYLLT.jsView file

•path = lib/chunks/RD4BYLLT.js kind = oversized_source_file sizeBytes = 4412487 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/chunks/RD4BYLLT.jsView on unpkg

lib/chunks/NRZEGU6G.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @redocly/cli@2.39.0 matchedIdentity = npm:QHJlZG9jbHkvY2xp:2.39.0 similarity = 0.793 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/chunks/NRZEGU6G.jsView on unpkg