@salla.sa/cli@3.2.31: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@salla.sa/cli@3.2.31: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/index.jsView file

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/salla.js -> dist/index.js L1: /*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L2

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

Source & flagged code

8 flagged

dist/index.jsView file

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/salla.js -> dist/index.js L1: /*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L1

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1

2patternName = generic_password severity = medium line = 2 matchedText = (()=>{va...)();

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L2

1/*! For license information please see index.js.LICENSE.txt */ L2: (()=>{var e={24916(e,t,n){const i=new(n(62116).Command);e.exports=function(){const e=i.command("app").description(global.content.commands.app.description);return e.command("create"...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1