@senguoyun/dsh-arkme@0.1.77: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@senguoyun/dsh-arkme@0.1.77: Suspicious npm security report | LPM Firewall

Source & flagged code

15 flagged · loading source

lib/profile-bundle-policy-Cwi2iuHi.jsView file

3import { basename, dirname, join, win32 } from "node:path"; L4: import { execFile, execFileSync, spawnSync } from "node:child_process"; L5: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

lib/profile-bundle-policy-Cwi2iuHi.jsView on unpkg · L3

lib/persistent-runtime-eUVtjdJU.jsView file

1import { createRequire } from "node:module"; L2: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L3: import { chmodSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node... L4: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { Readable } from "node:stream"; ... L10: import { fileURLToPath, fileURLToPath as urlToPath } from "node:url"; L11: import { request } from "node:http"; L12: import { homedir, tmpdir } from "node:os"; ... L19: import minproc from "n

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> lib/index.js -> lib/persistent-runtime-eUVtjdJU.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg

97948]; L97949: const closure = new Function(...parameters, `return (async () => {\n${spec.code}\n})()`); L97950: const harness = new Proxy({}, { get(_target, property) {

High

Eval

Package source references dynamic code evaluation.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L97948

1import { createRequire } from "node:module"; L2: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L3: import { chmodSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node... L4: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { Readable } from "node:stream"; ... L10: import { fileURLToPath, fileURLToPath as urlToPath } from "node:url"; L11: import { request } from "node:http"; L12: import { homedir, tmpdir } from "node:os"; ... L19: import minproc from "n

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L1

1import { createRequire } from "node:module"; L2: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L3: import { chmodSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node... L4: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { Readable } from "node:stream"; ... L10: import { fileURLToPath, fileURLToPath as urlToPath } from "node:url"; L11: import { request } from "node:http"; L12: import { homedir, tmpdir } from "node:os"; ... L19: import minproc from "n

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L1

lib/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @senguoyun/dsh-arkme@0.1.68 matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.68 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

38486dshBinPath, L38487: execArgv: process.execArgv, L38488: stateDirectory, L38489: healthUrl: `http://127.0.0.1:${String(ctx.webServer.port)}${config.routePath}`, L38490: restartArgv: [...process.execArgv, ...process.argv.slice(1)], ... L38492: installStoreDirectory: extensionDirectory, L38493: ...process.env.ARKME_DESKTOP_MANAGED_RESTART === "1" && process.env.ARKME_DESKTOP_MANAGED_RESTART_PLAN_PATH !== void 0 ? { L38494: supervisedExitCode: 75,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L38486

1import { A as inspectNativeBundleArtifactV3, At as [redacted], Ct as isRecentEmojiId, D as bundleSha256, Dt as retryAfterMillis, E as arkmeSandboxEntryId, Et... L2: import { a as securePrivateDirectory, c as securePrivateFileSync, i as prepareProfilePackageManager, n as isArkmeProfilePackageName, o as securePrivateDirectorySync, r as localExte... L3: import { _ as parsePluginUpdateManifest, b as [redacted], d as writePluginUpdateLifecycleLog, f as PluginUpdateInstallStateStore, g as existingCachedPluginAr... ... L6: import { createRequire } from "node:module"; L7: import WebSocket$2, { WebSocket as WebSocket$1, WebSocketServer } from "ws"; L8: import { createCipheriv, createDecipheriv, createHash, createHmac, getCiphers, randomBytes, randomUUID } from "node:crypto"; L9: import { chmodS

assets/windows/arkme-credential-helper.exeView file

•path = assets/windows/arkme-credential-helper.exe kind = native_binary sizeBytes = 2024816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/windows/arkme-credential-helper.exeView on unpkg

lib/client.jsView file

•path = lib/client.js kind = oversized_source_file sizeBytes = 9436127 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/client.jsView on unpkg

assets/desktop_call/bundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/desktop_call/bundle.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @senguoyun/dsh-arkme@0.1.52 matchedPath = assets/desktop_call/bundle.js matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/desktop_call/bundle.jsView on unpkg

Source & flagged code

15 flagged

lib/profile-bundle-policy-Cwi2iuHi.jsView file

3import { basename, dirname, join, win32 } from "node:path"; L4: import { execFile, execFileSync, spawnSync } from "node:child_process"; L5: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

lib/profile-bundle-policy-Cwi2iuHi.jsView on unpkg · L3

lib/persistent-runtime-eUVtjdJU.jsView file

1import { createRequire } from "node:module"; L2: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L3: import { chmodSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node... L4: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { Readable } from "node:stream"; ... L10: import { fileURLToPath, fileURLToPath as urlToPath } from "node:url"; L11: import { request } from "node:http"; L12: import { homedir, tmpdir } from "node:os"; ... L19: import minproc from "n

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L1

•Trigger-reachable chain: manifest.main -> lib/index.js -> lib/persistent-runtime-eUVtjdJU.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg

97948]; L97949: const closure = new Function(...parameters, `return (async () => {\n${spec.code}\n})()`); L97950: const harness = new Proxy({}, { get(_target, property) {

High

Eval

Package source references dynamic code evaluation.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L97948

1import { createRequire } from "node:module"; L2: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L3: import { chmodSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node... L4: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { Readable } from "node:stream"; ... L10: import { fileURLToPath, fileURLToPath as urlToPath } from "node:url"; L11: import { request } from "node:http"; L12: import { homedir, tmpdir } from "node:os"; ... L19: import minproc from "n

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L1

1import { createRequire } from "node:module"; L2: import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicKey, randomBytes, randomUUID, timingSafeEqual, verify } from "node:crypto"; L3: import { chmodSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node... L4: import minpath, { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path"; L5: import { execFile } from "node:child_process"; L6: import { Readable } from "node:stream"; ... L10: import { fileURLToPath, fileURLToPath as urlToPath } from "node:url"; L11: import { request } from "node:http"; L12: import { homedir, tmpdir } from "node:os"; ... L19: import minproc from "n

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/persistent-runtime-eUVtjdJU.jsView on unpkg · L1

lib/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @senguoyun/dsh-arkme@0.1.68 matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.68 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/index.jsView on unpkg

38486dshBinPath, L38487: execArgv: process.execArgv, L38488: stateDirectory, L38489: healthUrl: `http://127.0.0.1:${String(ctx.webServer.port)}${config.routePath}`, L38490: restartArgv: [...process.execArgv, ...process.argv.slice(1)], ... L38492: installStoreDirectory: extensionDirectory, L38493: ...process.env.ARKME_DESKTOP_MANAGED_RESTART === "1" && process.env.ARKME_DESKTOP_MANAGED_RESTART_PLAN_PATH !== void 0 ? { L38494: supervisedExitCode: 75,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/index.jsView on unpkg · L38486

1import { A as inspectNativeBundleArtifactV3, At as [redacted], Ct as isRecentEmojiId, D as bundleSha256, Dt as retryAfterMillis, E as arkmeSandboxEntryId, Et... L2: import { a as securePrivateDirectory, c as securePrivateFileSync, i as prepareProfilePackageManager, n as isArkmeProfilePackageName, o as securePrivateDirectorySync, r as localExte... L3: import { _ as parsePluginUpdateManifest, b as [redacted], d as writePluginUpdateLifecycleLog, f as PluginUpdateInstallStateStore, g as existingCachedPluginAr... ... L6: import { createRequire } from "node:module"; L7: import WebSocket$2, { WebSocket as WebSocket$1, WebSocketServer } from "ws"; L8: import { createCipheriv, createDecipheriv, createHash, createHmac, getCiphers, randomBytes, randomUUID } from "node:crypto"; L9: import { chmodS

assets/windows/arkme-credential-helper.exeView file

•path = assets/windows/arkme-credential-helper.exe kind = native_binary sizeBytes = 2024816 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/windows/arkme-credential-helper.exeView on unpkg

lib/client.jsView file

•path = lib/client.js kind = oversized_source_file sizeBytes = 9436127 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/client.jsView on unpkg

assets/desktop_call/bundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/desktop_call/bundle.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = @senguoyun/dsh-arkme@0.1.52 matchedPath = assets/desktop_call/bundle.js matchedIdentity = npm:QHNlbmd1b3l1bi9kc2gtYXJrbWU:0.1.52 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/desktop_call/bundle.jsView on unpkg