@sasjs/adapter: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@sasjs/adapter: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

src/job-execution/Sas9JobExecutor.tsView file

Lines 18-58typescript

18 constructor(

19 serverUrl: string,

20 serverType: ServerType,

21 private jobsPath: string,

22 private requestClient: RequestClient,

23 httpsAgentOptions?: https.AgentOptions

24 ) {

25 super(serverUrl, serverType)

26 this.sas9RequestClient = new Sas9RequestClient(serverUrl, httpsAgentOptions)

27 }

28

29 async execute(sasJob: string, data: any, config: any) {

30 const program = isRelativePath(sasJob)

31 ? config.appLoc

32 ? config.appLoc.replace(/\/?$/, '/') + sasJob.replace(/^\//, '')

33 : sasJob

34 : sasJob

35 let apiUrl = `${config.serverUrl}${this.jobsPath}?${'_program=' + program}`

36 apiUrl = `${apiUrl}${

37 config.username && config.password

38 ? '&_username=' + config.username + '&_password=' + config.password

Medium

Secret Pattern

Package contains a possible secret pattern.

src/job-execution/Sas9JobExecutor.tsView on unpkg · L38

39 : ''

40 }`

41

42 apiUrl = `${apiUrl}${config.debug ? '&_debug=131' : ''}`

43

44 let requestParams = {

45 ...this.getRequestParams(config)

46 }

47

48 let formData = new NodeFormData()

49

50 if (data) {

51 try {

52 formData = generateFileUploadForm(formData, data)

53 } catch (e: any) {

54 return Promise.reject(new ErrorResponse(e?.message, e))

55 }

56 } else {

57 data = ''

58 }

minified_sas9.jsView file

15411/******/ try { L15412: /******/ return this || new Function('return this')(); L15413: /******/ } catch (e) {

High

Eval

Package source references dynamic code evaluation.

minified_sas9.jsView on unpkg · L15411

node/index.jsView file

50rows.forEach((r) => { L51: this.push(Buffer.from(r, 'utf8')); L52: }); ... L427: const promiseWrite = util_1.promisify((row, cb) => { L428: csvStream.write(row, undefined, cb); L429: }); ... L1080: const getAbsolutePath = (providedPath, relativePath) => path_1.default.isAbsolute(providedPath) || /^~/.exec(providedPath) L1081: ? path_1.default.normalize(providedPath.replace(/^~/, os_1.default.homedir())) L1082: : path_1.default.join(relativePath, providedPath); ... L1187: exports.newLine = void 0; L1188: const newLine = () => (process.platform === 'win32' ? '\\r\\n' : '\\n'); L1189: exports.newLine = newLine;

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

node/index.jsView on unpkg · L50

index.jsView file

•path = index.js kind = oversized_source_file sizeBytes = 6316739 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

index.jsView on unpkg

package.jsonView file

Lines 1-25json

1{

2 "name": "@sasjs/adapter",

3 "description": "JavaScript adapter for SAS",

4 "homepage": "https://adapter.sasjs.io",

5 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.