Loading npm security reports…

@snapbox/cli@1.0.13: Suspicious npm security report (Warn) | LPM Firewall

registry / @snapbox/cli / 1.0.13

@snapbox/cli@1.0.13

CLI for Snapbox tools development

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsFilesystemShell

Supply chain

MinifiedObfuscated

Manifest

NoLicense

scanned 24 file(s), 63.1 KB of source

Source & flagged code

4 flagged

static/keys/debug.pemView file

Lines 1-21text

1-----BEGIN RSA PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

static/keys/debug.pemView on unpkg · L1

Critical

Secret Pattern

RSA private key in static/keys/debug.pem

static/keys/debug.pemView on unpkg · L1

2MIIEowIBAAKCAQEAkourKjfoYQTIXRSZkNBK3jWHmtGXWubtB9yHFY0MhWOtgkf9

3eSpjntbZb1wFhBXlkKMIcaav8GBMDlTETBSjje33wKc1zxMVSvCg25Em5vOJJCEw

4dsTSxVrk0ktLpvdgn3YLhKDI3NxNfL3uGYXrftLLtT0fwFstygGVUfCntnpZsTL5

5TgXPZVBpqbLVT8HjKRn3NTJ8aovpSdXrAnRbnYTUFc0QpczG06Tkg58k1KchRqvJ

6uaob9ZUWqUKedlch1lL+xalB4kynJR+5fgOShwiaDj5PeMsRyXfeWe6fboGku9L9

7TaIjfbUJtJJ3t53A8mr347T61wLu4gmeKqW/XQIDAQABAoIBABS6qaaaK/Ef/RD1

8lgIJr11z/aTlBYo35MraOJ16yzefHERegeNUH1gGP3w6FxRSXfEHWW1szQcCiB+g

9K/gwaduXZWvx+xw52ybeQigXhdo2FBhxPWq/d/+vVh4ib9FuvVMxHntPRw++yz3c

10RpmDplvVM42FLOryZYK6lfBLoLL2BXNM5DtSaAyztj8DxoW/drL8vGSrFK7V1/uU

11OxEpSleBWdDXUXBHK0pi2qmFHPuUxRvtkDegYW7aoABVTj/ho05cBAkHebtqQg6g

12yzTuQYgDQwtFAKHzI/TwTVLezXEpDZDGGMFZQ89sCnYHXudj5zBL2LdAEc4Gqv/9

13mGytwJ0CgYEAyS3cr/4Ycv1SJMCh/YYRpOeEVxVwqWV5xNzKBdWwZKHZxQxvQ+H8

14wXYETzrJxctzRy5KWUF4c45F9F1UMZ3cPYmnLQbn3ZlpQV2P14TryH1PYcTgxYN3

15ByHcpl+8jwuUtman2hDVYRMj/BrCN8oBtTVFExPCMGmowDVEgwWFrgsCgYEAunqZ

167alTrGKpMrXirJx293K6I/AEIvVQ165133KfGnJDu6lkN5vyiH5wZyOFzHIZqb/w

17XHiVHblQlUlYcP3t1qq/GiHHH7OL+VRY5+ZBhWXtKX0a+JqG/mtJv0uOE+KmRZdx

18zuOaWTiYyd5bxYk3TxFfalsKr3QyaoHukCRf8TcCgYEAhFA8iCeHLwG6598l61ck

19/Z8jJB8+xLqv1rEb0bCUXesxDe86spvMH/UdqnpQwF0pyVQBpChyLxYQnkJPoH5h

20nruNDwkusEk4t7vwYd/TLz5zWishZeYr/63esDHhEveb7Ech+EMAA+OR1DpJKGYc

21r3CEqKJjInIrgZbHI6EbJbcCgYA5TyZxSMGjT+rp38YbADb7kzGri77ps3S15DLr

static/templates/default/metro.config.jsView file

Lines 1-5javascript

1const { getDefaultConfig } = require("@snapbox/metro-config");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

static/templates/default/metro.config.jsView on unpkg · L1

3const config = getDefaultConfig(__dirname);

build/bin/snapbox.jsView file

Lines 1-2javascript

1#!/usr/bin/env node

2'use strict';function a0_0x3607(){const _0x4ed1a2=['-o,\x20--out\x20<path>','../lib/build','option','../lib/keygen','key.pem','path

Source & flagged code

4 flagged · loading source

static/keys/debug.pemView file

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

static/keys/debug.pemView on unpkg · L1

1patternName = private_key_rsa severity = critical line = 1 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in static/keys/debug.pem

static/keys/debug.pemView on unpkg · L1

static/templates/default/metro.config.jsView file

1const { getDefaultConfig } = require("@snapbox/metro-config"); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

static/templates/default/metro.config.jsView on unpkg · L1

Findings

2 Critical2 High3 Medium4 Low

CriticalCritical Secretstatic/keys/debug.pem

CriticalSecret Patternstatic/keys/debug.pem

HighObfuscated Payload Loaderbuild/bin/snapbox.js

HighObfuscated

MediumDynamic Requirestatic/templates/default/metro.config.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowNo License