@softtynet/zplus-worker@1.0.29: Suspicious npm security report

Loading npm security reports…

@softtynet/zplus-worker@1.0.29: Suspicious npm security report | LPM Firewall

Source & flagged code

11 flagged

105`:` L106: `),fe=ple.bind(null,{[tz]:"",[rz]:s,[iz]:V,[nz]:fw,[dw]:C,[oz]:N}),de="";p!==null&&(d===void 0?de=fe(p):de=fe(Object.assign({},p,{name:d})));let be=a instanceof Function?a:a?pz:Ole... L107: ==================================================================`),console.log("\u{1F510} ZPLUS WORKER TERMINAL LOGIN (HEADLESS LINUX / VPS)"),console.log("======================...

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L105

103Trigger-reachable chain: scripts.start -> dist/cli.js L103: ${m}${k} L104: ${v}`),_.pop(),`{${k}}`}case"number":return isFinite(g)?String(g):t?t(g):"null";case"boolean":return g===!0?"true":"false";case"undefined":return;case"bigint":if(n)return String(g)... L105: `:` L106: `),fe=ple.bind(null,{[tz]:"",[rz]:s,[iz]:V,[nz]:fw,[dw]:C,[oz]:N}),de="";p!==null&&(d===void 0?de=fe(p):de=fe(Object.assign({},p,{name:d})));let be=a instanceof Function?a:a?pz:Ole... L107: ==================================================================`),console.log("\u{1F510} ZPLUS WORKER TERMINAL LOGIN (HEADLESS LINUX / VPS)"),console.log("======================...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L103

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L105

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L105

103${m}${k} L104: ${v}`),_.pop(),`{${k}}`}case"number":return isFinite(g)?String(g):t?t(g):"null";case"boolean":return g===!0?"true":"false";case"undefined":return;case"bigint":if(n)return String(g)... L105: `:` L106: `),fe=ple.bind(null,{[tz]:"",[rz]:s,[iz]:V,[nz]:fw,[dw]:C,[oz]:N}),de="";p!==null&&(d===void 0?de=fe(p):de=fe(Object.assign({},p,{name:d})));let be=a instanceof Function?a:a?pz:Ole... L107: ==================================================================`),console.log("\u{1F510} ZPLUS WORKER TERMINAL LOGIN (HEADLESS LINUX / VPS)"),console.log("======================...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L103

1#!/usr/bin/env node L2: "use strict";var w$=Object.create;var Wm=Object.defineProperty;var _$=Object.getOwnPropertyDescriptor;var S$=Object.getOwnPropertyNames;var k$=Object.getPrototypeOf,E$=Object.proto... L3: \\[?(?: ... L20: `+_+"}":"{"+w.join(",")+"}",n=_,h}}typeof dE.stringify!="function"&&(dE.stringify=function(u,l,p){var d;if(n="",i="",typeof p=="number")for(d=0;d<p;d+=1)i+=" ";else typeof p=="stri... L21: `,r:"\r",t:" "},o,s=function(_){throw{name:"SyntaxError",message:_,at:r,text:o}},a=function(_){return _&&_!==n&&s("Expected '"+_+"' instead of '"+n+"'"),n=o.charAt(r),r+=1,n},c=fun... L22: Response: ${JSON.stringify(d,null,2)}`);let h=d.data;if(r)r({type:$n.QRCodeGenerated,data:Object.assign(Object.assign({},d.data),{image:d.data.image.replace(/^data:image\/png;base6... ... L

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

103Trigger-reachable command-output exfiltration chain: scripts.start -> dist/cli.js L103: ${m}${k} L104: ${v}`),_.pop(),`{${k}}`}case"number":return isFinite(g)?String(g):t?t(g):"null";case"boolean":return g===!0?"true":"false";case"undefined":return;case"bigint":if(n)return String(g)... L105: `:` L106: `),fe=ple.bind(null,{[tz]:"",[rz]:s,[iz]:V,[nz]:fw,[dw]:C,[oz]:N}),de="";p!==null&&(d===void 0?de=fe(p):de=fe(Object.assign({},p,{name:d})));let be=a instanceof Function?a:a?pz:Ole... L107: ==================================================================`),console.log("\u{1F510} ZPLUS WORKER TERMINAL LOGIN (HEADLESS LINUX / VPS)"),console.log("======================...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L103

1Trigger-reachable persistence chain: scripts.start -> dist/cli.js L1: #!/usr/bin/env node L2: "use strict";var w$=Object.create;var Wm=Object.defineProperty;var _$=Object.getOwnPropertyDescriptor;var S$=Object.getOwnPropertyNames;var k$=Object.getPrototypeOf,E$=Object.proto... L3: \\[?(?: ... L20: `+_+"}":"{"+w.join(",")+"}",n=_,h}}typeof dE.stringify!="function"&&(dE.stringify=function(u,l,p){var d;if(n="",i="",typeof p=="number")for(d=0;d<p;d+=1)i+=" ";else typeof p=="stri... L21: `,r:"\r",t:" "},o,s=function(_){throw{name:"SyntaxError",message:_,at:r,text:o}},a=function(_){return _&&_!==n&&s("Expected '"+_+"' instead of '"+n+"'"),n=o.charAt(r),r+=1,n},c=fun... L22: Response: ${JSON.stringify(d,null,2)}`);let h=d.data;if(r)r({type:$n.QRCodeGenerated,data:Object.assign(Object.assign({},d.

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

167</plist> L168: `;yt.default.writeFileSync(s,a,"utf-8");try{(0,ht.execSync)(`launchctl unload "${s}" 2>/dev/null || true`),(0,ht.execSync)(`launchctl load -w "${s}"`)}catch(c){this.logger.debug("l... L169: \u{1F4A1} Worker s\u1EBD t\u1EF1 kh\u1EDFi \u0111\u1ED9ng c\xF9ng macOS sau khi b\u1EADt m\xE1y ho\u1EB7c s\u1EADp ngu\u1ED3n.`}}if(t==="win32"){let o=`"${r}" "${n}" start`,s=!1;tr... ... L177: C\xDA PH\xC1P: L178: npx @softtynet/zplus-worker [l\u1EC7nh] [t\xF9y ch\u1ECDn] L179:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L167

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Source & flagged code

11 flagged · loading source

dist/cli.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L105

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L103

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L105

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L105

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L103

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L103

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L167

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Source & flagged code

11 flagged

dist/cli.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L105

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L103

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L105

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L105

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L103

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L103

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L167

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

@softtynet/zplus-worker@1.0.29

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code