@senguoyun/dsh-arkme@0.1.59: Suspicious npm security report

Loading npm security reports…

@senguoyun/dsh-arkme@0.1.59: Suspicious npm security report | LPM Firewall

Source & flagged code

18 flagged

lib/extension-profile-restart-helper.jsView file

4import { readFile, rm, unlink } from "node:fs/promises"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { join, relative, resolve } from "node:path";

High

Child Process

Package source references child process execution.

lib/extension-profile-restart-helper.jsView on unpkg · L4

24dshBinPath: stringValue(source.dshBinPath), L25: execArgv: Array.isArray(source.execArgv) ? source.execArgv.filter((item) => stringValue(item) !== void 0) : [], L26: restartArgv: Array.isArray(source.restartArgv) ? source.restartArgv.filter((item) => stringValue(item) !== void 0) : [],

High

Shell

Package source references shell execution.

lib/extension-profile-restart-helper.jsView on unpkg · L24

•matchType = normalized_sha256 matchedPackage = @senguoyun/dsh-arkme@0.1.52 matchedPath = lib/extension-profile-restart-helper.js matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extension-profile-restart-helper.jsView on unpkg

lib/persistent-runtime-ByM3JB3z.jsView file

4import { chmod as chmod$1, copyFile, link, lstat, mkdir, open, opendir, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises"; L5: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L6: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; ... L8: import { gunzipSync, gzipSync } from "node:zlib"; L9: import { request } from "node:http"; L10: import { homedir } from "node:os"; ... L14: import minproc from "node:process"; L15: import { Resolver, lookup } from "node:dns/promises"; L16: import OSS from "ali-oss"; ... L108: }, L109: body: JSON.stringify({ L110: schemaVersion: 1,

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/persistent-runtime-ByM3JB3z.jsView on unpkg · L4

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/persistent-runtime-ByM3JB3z.jsView on unpkg · L4

lib/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @senguoyun/dsh-arkme@0.1.53 matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.53 similarity = 0.609 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

36584dshBinPath, L36585: execArgv: process.execArgv, L36586: stateDirectory, L36587: healthUrl: `http://127.0.0.1:${String(ctx.webServer.port)}${config.routePath}`, L36588: restartArgv: [...process.execArgv, ...process.argv.slice(1)], ... L36590: installStoreDirectory: extensionDirectory, L36591: ...process.env.ARKME_DESKTOP_MANAGED_RESTART === "1" && process.env.ARKME_DESKTOP_MANAGED_RESTART_PLAN_PATH !== void 0 ? { L36592: supervisedExitCode: 75,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L36584

2import { _ as parsePluginUpdateManifest, b as [redacted], d as writePluginUpdateLifecycleLog, f as PluginUpdateInstallStateStore, g as existingCachedPluginAr... L3: import { a as securePrivateDirectory, c as securePrivateFileSync, i as prepareProfilePackageManager, n as isArkmeProfilePackageName, o as securePrivateDirectorySync, r as localExte... L4: import { i as invokeArkmeBundle, n as arkmeBundleActive, r as deactivateArkmeBundle } from "./bundle-runtime-CE73h3vS.js"; ... L8: import { appendFile, chmod as chmod$1, mkdir, open, readFile, readdir, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises"; L9: import { createCipheriv, createDecipheriv, createHash, createHmac, getCiphers, randomBytes, randomUUID } from "node:crypto"; L10: import { execFile, spawn } from "n

lib/client.jsView file

57//#region src/types.ts L58: const ARKME_DEFAULT_SHARE_WEBSITE = "https://app.arkme.ai"; L59: //#endregion ... L87: //#region src/extensions/types.ts L88: /** Browser/model-safe projection. Host filesystem paths and Dynamic Cordis IDs stay private. */ L89: const ARKME_EXTENSION_RUNTIME_UNAVAILABLE_MESSAGE = "插件运行失败，已自动停用。"; ... L259: }, L260: body: file, L261: ...options.signal === void 0 ? {} : { signal: options.signal } ... L264: try { L265: body = await response.json(); L266: } catch {

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/client.jsView on unpkg · L57

•path = lib/client.js kind = oversized_source_file sizeBytes = 8301097 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/client.jsView on unpkg

assets/windows/arkme-credential-helper.exeView file

•path = assets/windows/arkme-credential-helper.exe kind = native_binary sizeBytes = 2024816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/windows/arkme-credential-helper.exeView on unpkg

assets/desktop_call/bundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/desktop_call/bundle.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @senguoyun/dsh-arkme@0.1.52 matchedPath = assets/desktop_call/bundle.js matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/desktop_call/bundle.jsView on unpkg

lib/profile-bundle-policy-DLXDyohJ.jsView file

•matchType = normalized_sha256 matchedPackage = @senguoyun/dsh-arkme@0.1.52 matchedPath = lib/profile-bundle-policy-DLXDyohJ.js matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/profile-bundle-policy-DLXDyohJ.jsView on unpkg

lib/plugin-updater-helper-y7wzJLOx.jsView file

•matchType = normalized_sha256 matchedPackage = @senguoyun/dsh-arkme@0.1.52 matchedPath = lib/plugin-updater-helper-y7wzJLOx.js matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/plugin-updater-helper-y7wzJLOx.jsView on unpkg

Source & flagged code

18 flagged · loading source

lib/extension-profile-restart-helper.jsView file

4import { readFile, rm, unlink } from "node:fs/promises"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { join, relative, resolve } from "node:path";

High

Child Process

Package source references child process execution.

lib/extension-profile-restart-helper.jsView on unpkg · L4

High

Shell

Package source references shell execution.

lib/extension-profile-restart-helper.jsView on unpkg · L24

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extension-profile-restart-helper.jsView on unpkg

lib/persistent-runtime-ByM3JB3z.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/persistent-runtime-ByM3JB3z.jsView on unpkg · L4

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/persistent-runtime-ByM3JB3z.jsView on unpkg · L4

lib/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L36584

lib/client.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/client.jsView on unpkg · L57

•path = lib/client.js kind = oversized_source_file sizeBytes = 8301097 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/client.jsView on unpkg

assets/windows/arkme-credential-helper.exeView file

•path = assets/windows/arkme-credential-helper.exe kind = native_binary sizeBytes = 2024816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/windows/arkme-credential-helper.exeView on unpkg

assets/desktop_call/bundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/desktop_call/bundle.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/desktop_call/bundle.jsView on unpkg

lib/profile-bundle-policy-DLXDyohJ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/profile-bundle-policy-DLXDyohJ.jsView on unpkg

lib/plugin-updater-helper-y7wzJLOx.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/plugin-updater-helper-y7wzJLOx.jsView on unpkg

Source & flagged code

18 flagged

lib/extension-profile-restart-helper.jsView file

4import { readFile, rm, unlink } from "node:fs/promises"; L5: import { spawn, spawnSync } from "node:child_process"; L6: import { join, relative, resolve } from "node:path";

High

Child Process

Package source references child process execution.

lib/extension-profile-restart-helper.jsView on unpkg · L4

High

Shell

Package source references shell execution.

lib/extension-profile-restart-helper.jsView on unpkg · L24

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/extension-profile-restart-helper.jsView on unpkg

lib/persistent-runtime-ByM3JB3z.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/persistent-runtime-ByM3JB3z.jsView on unpkg · L4

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/persistent-runtime-ByM3JB3z.jsView on unpkg · L4

lib/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L36584

lib/client.jsView file

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/client.jsView on unpkg · L57

•path = lib/client.js kind = oversized_source_file sizeBytes = 8301097 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/client.jsView on unpkg

assets/windows/arkme-credential-helper.exeView file

•path = assets/windows/arkme-credential-helper.exe kind = native_binary sizeBytes = 2024816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/windows/arkme-credential-helper.exeView on unpkg

assets/desktop_call/bundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/desktop_call/bundle.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/desktop_call/bundle.jsView on unpkg

lib/profile-bundle-policy-DLXDyohJ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/profile-bundle-policy-DLXDyohJ.jsView on unpkg

lib/plugin-updater-helper-y7wzJLOx.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/plugin-updater-helper-y7wzJLOx.jsView on unpkg

@senguoyun/dsh-arkme@0.1.59

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code