@remixhq/claude-plugin@0.1.53: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@remixhq/claude-plugin@0.1.53: Suspicious npm security report | LPM Firewall

Source & flagged code

4 flagged

dist/hook-post-collab.cjsView file

Lines 1-61javascript

1#!/usr/bin/env node

2"use strict";

3var __create = Object.create;

4var __defProp = Object.defineProperty;

5var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

6var __getOwnPropNames = Object.getOwnPropertyNames;

7var __getProtoOf = Object.getPrototypeOf;

8var __hasOwnProp = Object.prototype.hasOwnProperty;

9var __commonJS = (cb, mod) => function __require() {

10 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hook-post-collab.cjsView on unpkg · L8

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

16var __copyProps = (to, from, except, desc) => {

17 if (from && typeof from === "object" || typeof from === "function") {

18 for (let key of __getOwnPropNames(from))

19 if (!__hasOwnProp.call(to, key) && key !== except)

20 __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });

21 }

22 return to;

23};

24var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(

25 // If the importer is in node compatibility mode or this is not an ESM

26 // file that has been converted to a CommonJS file using a Babel-

27 // compatible transform (i.e. "__esModule" has not been set), then set

28 // "default" to the CommonJS "module.exports" for node compatibility.

29 isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,

30 mod

31));

32var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

33

34// node_modules/isexe/windows.js

35var require_windows = __commonJS({

36 "node_modules/isexe/windows.js"(exports2, module2) {

37 "use strict";

38 module2.exports = isexe;

39 isexe.sync = sync;

40 var fs8 = require("fs");

41 function checkPathExt(path12, options) {

42 var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;

43 if (!pathext) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/hook-post-collab.cjsView on unpkg · L41

44 return true;

45 }

46 pathext = pathext.split(";");

47 if (pathext.indexOf("") !== -1) {

48 return true;

49 }

50 for (var i2 = 0; i2 < pathext.length; i2++) {

51 var p = pathext[i2].toLowerCase();

52 if (p && path12.substr(-p.length).toLowerCase() === p) {

53 return true;

54 }

55 }

56 return false;

57 }

58 function checkStat(stat, path12, options) {

59 if (!stat.isSymbolicLink() && !stat.isFile()) {

60 return false;

61 }

Lines 491-531javascript

491 return null;

492 }

493 function verifyENOENTSync(status, parsed) {

494 if (isWin && status === 1 && !parsed.file) {

dist/hook-stop-collab.cjsView file

17282} L17283: var loadKeytarModule = () => new Function("return import('keytar')")(); L17284: function xdgConfigHome() {

High

Eval

Package source references dynamic code evaluation.

dist/hook-stop-collab.cjsView on unpkg · L17282