@servicetitan/startup@38.1.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@servicetitan/startup@38.1.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./src/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/_run.jsView file

13*/ L14: const { execFileSync } = require('child_process'); L15: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/_run.jsView on unpkg · L13

dist/cli/tasks/cli-task.jsView file

10}); L11: const _execa = /*#__PURE__*/ _interop_require_default(require("execa")); L12: const _utils = require("../../utils");

High

Shell

Package source references shell execution.

dist/cli/tasks/cli-task.jsView on unpkg · L10

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView file

9// This works if eval is allowed (see CSP) L10: result = this || new Function('return this')(); L11: } catch (e) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView on unpkg · L9

bin/webpack.jsView file

2// Auto-generated by scripts/generate-bin-wrappers.js - wraps: webpack -> bin/webpack.js L3: require('./_run')('webpack', 'bin/webpack.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/webpack.jsView on unpkg · L2

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView file

51define: { L52: 'process.env.NODE_ENV': JSON.stringify(env.mode), L53: },

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView on unpkg · L51

dist/cli/commands/clean.jsView file

63_utils.log.info(`Running: ${command}`); L64: await exec(command); L65: } catch (error) { ... L78: const npxCachePath = _nodepath.default.join(npmCacheDir, '_npx'); L79: _utils.log.info('Clearing npx cache'); L80: await _nodefs.default.promises.rm(npxCachePath, {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/commands/clean.jsView on unpkg · L63

dist/cli/commands/upload-sourcemaps.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @servicetitan/startup@37.0.1 matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:37.0.1 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/upload-sourcemaps.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 65-105json

65 "stylelint": "./bin/stylelint.js",

66 "swc": "./bin/swc.js",

67 "swcx": "./bin/swcx.js",

68 "tcm": "./bin/tcm.js",

69 "ts-jest": "./bin/ts-jest.js",

70 "ts-node": "./bin/ts-node.js",

71 "ts-node-cwd": "./bin/ts-node-cwd.js",

72 "ts-node-esm": "./bin/ts-node-esm.js",

73 "ts-node-script": "./bin/ts-node-script.js",

74 "ts-node-transpile-only": "./bin/ts-node-transpile-only.js",

75 "ts-script": "./bin/ts-script.js",

76 "tsc": "./bin/tsc.js",

77 "tsserver": "./bin/tsserver.js",

78 "vite": "./bin/vite.js",

79 "vitest": "./bin/vitest.js",

80 "webpack": "./bin/webpack.js",

81 "webpack-bundle-analyzer": "./bin/webpack-bundle-analyzer.js",

82 "webpack-dev-server": "./bin/webpack-dev-server.js"

83 },

84 "scripts": {

85 "postinstall": "node ./src/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L85

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L85

86 "prepare": "node ./src/scripts/generate-bin-wrappers.js"

87 },

88 "devDependencies": {

89 "@swc/types": "^0.1.27",

90 "@types/cpx": "~1.5.5",

91 "@types/debug": "^4.1.12",

92 "@types/eslint": "~9.6.1",

93 "@types/js-yaml": "^4.0.9",

94 "@types/less": "~3.0.8",

95 "@types/lodash.kebabcase": "^4.1.9",

96 "@types/lodash.memoize": "^4.1.9",

97 "@types/moment-locales-webpack-plugin": "~1.2.2",

98 "@types/webpack-assets-manifest": "~5.1.4",

99 "@types/yargs": "~17.0.35"

100 },

101 "dependencies": {

102 "@babel/preset-env": "~7.29.7",

103 "@jest/core": "~30.4.2",

104 "@jest/types": "~30.4.1",

105 "@jsdevtools/coverage-istanbul-loader": "^3.0.5",

bin/_run.jsView file

Lines 1-33javascript

1/**

2 * Shared helper for bin wrappers generated by scripts/generate-bin-wrappers.js.

3 *

4 * Locates a dependency's bin script by walking up the node_modules tree from

5 * the caller's directory, then executes it with the same argv. Works with both

6 * npm (flat hoisting) and pnpm (strict isolation).

7 *

8 * Caveat (npm only): if npm nests a different version of a package inside

9 * startup's node_modules and startup's bin wrapper is installed last, the

10 * consumer may get startup's version instead of their own. Keeping versions

dist/cli/tasks/cli-task.jsView file

Lines 1-30javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", {

3 value: true

4});

5Object.defineProperty(exports, "CliTask", {

6 enumerable: true

dist/webpack/loaders/expose-loader/runtime/get-global-this.jsView file

Lines 1-28javascript

1"use strict";

2/* eslint-disable */ // @ts-nocheck

3module.exports = function() {

4 if (typeof globalThis === 'object') {

bin/webpack.jsView file

Lines 1-4javascript

1#!/usr/bin/env node

2// Auto-generated by scripts/generate-bin-wrappers.js - wraps: webpack -> bin/webpack.js

3require('./_run')('webpack', 'bin/webpack.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/webpack.jsView on unpkg · L2

4

src/vite/plugins/shared-dependencies-plugin/shared-dependencies-plugin.tsView file

Lines 31-71typescript

31

32 return {

33 name: 'st:shared-dependencies',

34 enforce: 'pre',

35

36 config(_, env) {

37 isProduction

dist/cli/commands/clean.jsView file

Lines 43-83javascript

43var CleanProcesses = /*#__PURE__*/ function(CleanProcesses) {

44 CleanProcesses[CleanProcesses["CleanGitWorkingTree"] = 0] = "CleanGitWorkingTree";

45 CleanProcesses[CleanProcesses["ClearJestCache"] =

dist/cli/commands/upload-sourcemaps.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @servicetitan/startup@37.0.1 matchedIdentity = npm:QHNlcnZpY2V0aXRhbi9zdGFydHVw:37.0.1 similarity = 0.600 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/commands/upload-sourcemaps.jsView on unpkg