@softtynet/zplus-worker@1.0.18: Suspicious npm security report

Loading npm security reports…

@softtynet/zplus-worker@1.0.18: Suspicious npm security report | LPM Firewall

Source & flagged code

15 flagged

155`);return a!==-1&&(t=jKe(t,n,o,a)),o+t+n};Object.defineProperties(lk.prototype,KE);A_n=lk(),lOi=lk({level:HKe?HKe.level:0}),$Ke=A_n});function Uce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,I_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),w_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),P_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},aAn),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... ... L166: `;case"":case"":case"":case"":return"*";case"":case"":return"**";case"~!":case"!~":return"||";case"&":return"&";case"'":return"'";case"<":return"... L167: `;return GW.default.writeFileS

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L155

153Trigger-reachable chain: scripts.start -> dist/cli.js L153: `)+r,n=o+1,o=e.indexOf(` L154: `,n)}while(o!==-1);return a+=e.slice(n),a}var GKe=me(()=>{});function lk(e){return g_n(e)}var KKe,HKe,Lce,GE,ck,VKe,KE,m_n,g_n,qce,O_n,M_n,Bce,wW,__n,A_n,lOi,$Ke,JKe=me(()=>{LKe();... L155: `);return a!==-1&&(t=jKe(t,n,o,a)),o+t+n};Object.defineProperties(lk.prototype,KE);A_n=lk(),lOi=lk({level:HKe?HKe.level:0}),$Ke=A_n});function Uce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,I_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),w_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),P_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},aAn),typeof this.#l?.unref=="function"&&this.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L153

166`;case"":case"":case"":case"":return"*";case"":case"":return"**";case"~!":case"!~":return"||";case"&":return"&";case"'":return"'";case"<":return"... L167: `;return GW.default.writeFileSync(e,r,"utf8"),gt(`Created ${uue.default.basename(e)} in ${process.cwd()} (defaults).`,"info"),{config:t,configPath:e,exists:!0}}catch(t){let r=t&&t.... L168: \\[?(?:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L166

155`);return a!==-1&&(t=jKe(t,n,o,a)),o+t+n};Object.defineProperties(lk.prototype,KE);A_n=lk(),lOi=lk({level:HKe?HKe.level:0}),$Ke=A_n});function Uce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,I_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),w_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),P_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},aAn),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... L158: `))o+=Math.max(1,Math.ceil(ile(n)/r));return o}get color(){return this.#f}set color(t){if(t!==void 0&&t!==!1&&!lAn.has(t))throw new Error("The `color` option must be a valid color ... ... L166: `;case"":case"":case"</

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L155

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `,r:"\r",t:" "},a,i=function(M){throw{name:"SyntaxError",message:M,at:r,text:a}},s=function(M){return M&&M!==o&&i("Expected '"+M+"' instead of '"+o+"'"),o=a.charAt(r),r+=1,o},c=fun... `).map(t=>t.trim()).join(" ")};IPe.O=function(e){return this.inspectOpts.colors=this.useColors,uL.inspect(e,this.inspectOpts)}});var xn=L((hsi,_Y)=>{typeof process>"u"||process.typ... `;if(o.username||o.password){let y=`${decodeURIComponent(o.username)}:${decodeURIComponent(o.password)}`;a["Proxy-Authorization"]=`Basic ${Buffer.from(y).toString("base64")}`}a.Hos... `)}function JY(e){let t={interpolation:"rgb",hsvSpin:"short",...e};if(e!==void

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

153`)+r,n=o+1,o=e.indexOf(` L154: `,n)}while(o!==-1);return a+=e.slice(n),a}var GKe=me(()=>{});function lk(e){return g_n(e)}var KKe,HKe,Lce,GE,ck,VKe,KE,m_n,g_n,qce,O_n,M_n,Bce,wW,__n,A_n,lOi,$Ke,JKe=me(()=>{LKe();... L155: `);return a!==-1&&(t=jKe(t,n,o,a)),o+t+n};Object.defineProperties(lk.prototype,KE);A_n=lk(),lOi=lk({level:HKe?HKe.level:0}),$Ke=A_n});function Uce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,I_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),w_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),P_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},aAn),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... L158: `))

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L153

1#!/usr/bin/env node L2: "use strict";var VIt=Object.create;var C6=Object.defineProperty;var $It=Object.getOwnPropertyDescriptor;var JIt=Object.getOwnPropertyNames;var XIt=Object.getPrototypeOf,YIt=Object.... L3: \\[?(?: ... L28: `;rr.DEFAULT_CONTENT_TYPE="application/octet-stream";rr.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var o=KX.prototype.append.bind(this);if((typeo... L29: `).some(o=>o.indexOf("(https.js:")!==-1||o.indexOf("node:https:")!==-1)}incrementSockets(t){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;this.sockets[t]||(this.... L30: `).join(` ... L32: `)}function hqt(e){e?process.env.DEBUG=e:delete process.env.DEBUG}function yqt(){return process.env.DEBUG}function bqt(e){e.inspectOpts={};let t=Object.keys(_s.inspectOpt

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

153Trigger-reachable command-output exfiltration chain: scripts.start -> dist/cli.js L153: `)+r,n=o+1,o=e.indexOf(` L154: `,n)}while(o!==-1);return a+=e.slice(n),a}var GKe=me(()=>{});function lk(e){return g_n(e)}var KKe,HKe,Lce,GE,ck,VKe,KE,m_n,g_n,qce,O_n,M_n,Bce,wW,__n,A_n,lOi,$Ke,JKe=me(()=>{LKe();... L155: `);return a!==-1&&(t=jKe(t,n,o,a)),o+t+n};Object.defineProperties(lk.prototype,KE);A_n=lk(),lOi=lk({level:HKe?HKe.level:0}),$Ke=A_n});function Uce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,I_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),w_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),P_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},aAn),typeof this.

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L153

1Trigger-reachable persistence chain: scripts.start -> dist/cli.js L1: #!/usr/bin/env node L2: "use strict";var VIt=Object.create;var C6=Object.defineProperty;var $It=Object.getOwnPropertyDescriptor;var JIt=Object.getOwnPropertyNames;var XIt=Object.getPrototypeOf,YIt=Object.... L3: \\[?(?: ... L28: `;rr.DEFAULT_CONTENT_TYPE="application/octet-stream";rr.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var o=KX.prototype.append.bind(this);if((typeo... L29: `).some(o=>o.indexOf("(https.js:")!==-1||o.indexOf("node:https:")!==-1)}incrementSockets(t){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;this.sockets[t]||(this.... L30: `).join(` ... L32: `)}function hqt(e){e?process.env.DEBUG=e:delete process.env.DEBUG}function yqt(){return process.env.DEBU

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

196${r} L197: ${G9(t)}</${e.tag}>`:"/>";return o+n}var hft,Yn,ov,et,ep,ri,lde,tp,ude,G9,pde=me(()=>{hft=ke(sc(),1);ao();cde();Yn=(e,t)=>Array.isArray(e?.content)?e.content.filter(r=>r.tag===t):[... L198: `))}});var Idt=L((rhr,vdt)=>{var rNn=require("node:util"),Ade=require("node:stream"),oNn=Sh();GC();var aNn=rNn.debuglog("sharp"),sNn=e=>{pA.queue.emit("change",e)},pA=function(e,t)...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L196

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

•path = dist/cli.js kind = oversized_source_file sizeBytes = 8018336 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 8018336 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Source & flagged code

15 flagged · loading source

dist/cli.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L155

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L153

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L166

155`);return a!==-1&&(t=jKe(t,n,o,a)),o+t+n};Object.defineProperties(lk.prototype,KE);A_n=lk(),lOi=lk({level:HKe?HKe.level:0}),$Ke=A_n});function Uce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,I_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),w_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),P_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},aAn),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... L158: `))o+=Math.max(1,Math.ceil(ile(n)/r));return o}get color(){return this.#f}set color(t){if(t!==void 0&&t!==!1&&!lAn.has(t))throw new Error("The `color` option must be a valid color ... ... L166: `;case"":case"":case"</

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L155

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L153

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L153

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L196

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

•path = dist/cli.js kind = oversized_source_file sizeBytes = 8018336 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 8018336 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

@softtynet/zplus-worker@1.0.18

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code