@softtynet/zplus-worker@1.0.6: Suspicious npm security report

Loading npm security reports…

@softtynet/zplus-worker@1.0.6: Suspicious npm security report | LPM Firewall

Source & flagged code

15 flagged

155`);return a!==-1&&(t=LKe(t,n,o,a)),o+t+n};Object.defineProperties(oC.prototype,jE);f_n=oC(),Z2i=oC({level:UKe?UKe.level:0}),FKe=f_n});function Nce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,m_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),g_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),O_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},X_n),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... ... L166: `;case"":case"":case"":case"":return"*";case"":case"":return"**";case"~!":case"!~":return"||";case"&":return"&";case"'":return"'";case"<":return"... L167: `;return UW.default.writeFileS

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L155

153Trigger-reachable chain: scripts.start -> dist/cli.js L153: `)+r,n=o+1,o=e.indexOf(` L154: `,n)}while(o!==-1);return a+=e.slice(n),a}var qKe=me(()=>{});function oC(e){return c_n(e)}var BKe,UKe,xce,FE,rC,WKe,jE,s_n,c_n,Cce,l_n,u_n,kce,EW,p_n,f_n,Z2i,FKe,jKe=me(()=>{RKe();... L155: `);return a!==-1&&(t=LKe(t,n,o,a)),o+t+n};Object.defineProperties(oC.prototype,jE);f_n=oC(),Z2i=oC({level:UKe?UKe.level:0}),FKe=f_n});function Nce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,m_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),g_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),O_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},X_n),typeof this.#l?.unref=="function"&&this.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L153

166`;case"":case"":case"":case"":return"*";case"":case"":return"**";case"~!":case"!~":return"||";case"&":return"&";case"'":return"'";case"<":return"... L167: `;return UW.default.writeFileSync(e,r,"utf8"),gt(`Created ${oue.default.basename(e)} in ${process.cwd()} (defaults).`,"info"),{config:t,configPath:e,exists:!0}}catch(t){let r=t&&t.... L168: \\[?(?:

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L166

155`);return a!==-1&&(t=LKe(t,n,o,a)),o+t+n};Object.defineProperties(oC.prototype,jE);f_n=oC(),Z2i=oC({level:UKe?UKe.level:0}),FKe=f_n});function Nce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,m_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),g_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),O_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},X_n),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... L158: `))o+=Math.max(1,Math.ceil(Qce(n)/r));return o}get color(){return this.#f}set color(t){if(t!==void 0&&t!==!1&&!Z_n.has(t))throw new Error("The `color` option must be a valid color ... ... L166: `;case"":case"":case"</

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L155

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/cli.js: `,r:"\r",t:" "},a,i=function(M){throw{name:"SyntaxError",message:M,at:r,text:a}},s=function(M){return M&&M!==o&&i("Expected '"+M+"' instead of '"+o+"'"),o=a.charAt(r),r+=1,o},c=fun... `).map(t=>t.trim()).join(" ")};_Pe.O=function(e){return this.inspectOpts.colors=this.useColors,aL.inspect(e,this.inspectOpts)}});var xn=L((rsi,bY)=>{typeof process>"u"||process.typ... `;if(o.username||o.password){let y=`${decodeURIComponent(o.username)}:${decodeURIComponent(o.password)}`;a["Proxy-Authorization"]=`Basic ${Buffer.from(y).toString("base64")}`}a.Hos... `)}function GY(e){let t={interpolation:"rgb",hsvSpin:"short",...e};if(e!==void

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

153`)+r,n=o+1,o=e.indexOf(` L154: `,n)}while(o!==-1);return a+=e.slice(n),a}var qKe=me(()=>{});function oC(e){return c_n(e)}var BKe,UKe,xce,FE,rC,WKe,jE,s_n,c_n,Cce,l_n,u_n,kce,EW,p_n,f_n,Z2i,FKe,jKe=me(()=>{RKe();... L155: `);return a!==-1&&(t=LKe(t,n,o,a)),o+t+n};Object.defineProperties(oC.prototype,jE);f_n=oC(),Z2i=oC({level:UKe?UKe.level:0}),FKe=f_n});function Nce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,m_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),g_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),O_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},X_n),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... L158: `))

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L153

1#!/usr/bin/env node L2: "use strict";var BIt=Object.create;var z6=Object.defineProperty;var UIt=Object.getOwnPropertyDescriptor;var WIt=Object.getOwnPropertyNames;var FIt=Object.getPrototypeOf,jIt=Object.... L3: \\[?(?: ... L28: `;rr.DEFAULT_CONTENT_TYPE="application/octet-stream";rr.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var o=UX.prototype.append.bind(this);if((typeo... L29: `).some(o=>o.indexOf("(https.js:")!==-1||o.indexOf("node:https:")!==-1)}incrementSockets(t){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;this.sockets[t]||(this.... L30: `).join(` ... L32: `)}function rqt(e){e?process.env.DEBUG=e:delete process.env.DEBUG}function oqt(){return process.env.DEBUG}function aqt(e){e.inspectOpts={};let t=Object.keys(_s.inspectOpt

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

153Trigger-reachable command-output exfiltration chain: scripts.start -> dist/cli.js L153: `)+r,n=o+1,o=e.indexOf(` L154: `,n)}while(o!==-1);return a+=e.slice(n),a}var qKe=me(()=>{});function oC(e){return c_n(e)}var BKe,UKe,xce,FE,rC,WKe,jE,s_n,c_n,Cce,l_n,u_n,kce,EW,p_n,f_n,Z2i,FKe,jKe=me(()=>{RKe();... L155: `);return a!==-1&&(t=LKe(t,n,o,a)),o+t+n};Object.defineProperties(oC.prototype,jE);f_n=oC(),Z2i=oC({level:UKe?UKe.level:0}),FKe=f_n});function Nce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,m_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),g_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),O_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},X_n),typeof this.

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L153

1Trigger-reachable persistence chain: scripts.start -> dist/cli.js L1: #!/usr/bin/env node L2: "use strict";var BIt=Object.create;var z6=Object.defineProperty;var UIt=Object.getOwnPropertyDescriptor;var WIt=Object.getOwnPropertyNames;var FIt=Object.getPrototypeOf,jIt=Object.... L3: \\[?(?: ... L28: `;rr.DEFAULT_CONTENT_TYPE="application/octet-stream";rr.prototype.append=function(e,t,r){r=r||{},typeof r=="string"&&(r={filename:r});var o=UX.prototype.append.bind(this);if((typeo... L29: `).some(o=>o.indexOf("(https.js:")!==-1||o.indexOf("node:https:")!==-1)}incrementSockets(t){if(this.maxSockets===1/0&&this.maxTotalSockets===1/0)return null;this.sockets[t]||(this.... L30: `).join(` ... L32: `)}function rqt(e){e?process.env.DEBUG=e:delete process.env.DEBUG}function oqt(){return process.env.DEBU

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

196${r} L197: ${U9(t)}</${e.tag}>`:"/>";return o+n}var cft,Yn,iv,et,ep,ri,rde,tp,ode,U9,ade=me(()=>{cft=ke(sc(),1);ao();ide();Yn=(e,t)=>Array.isArray(e?.content)?e.content.filter(r=>r.tag===t):[... L198: `))}});var _dt=L(($dr,Mdt)=>{var $kn=require("node:util"),mde=require("node:stream"),Jkn=_h();Uk();var Xkn=$kn.debuglog("sharp"),Ykn=e=>{cA.queue.emit("change",e)},cA=function(e,t)...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L196

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

•path = dist/cli.js kind = oversized_source_file sizeBytes = 8004165 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 8004165 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

Source & flagged code

15 flagged · loading source

dist/cli.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/cli.jsView on unpkg · L155

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L153

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L166

155`);return a!==-1&&(t=LKe(t,n,o,a)),o+t+n};Object.defineProperties(oC.prototype,jE);f_n=oC(),Z2i=oC({level:UKe?UKe.level:0}),FKe=f_n});function Nce(e,t,{ignoreNonConfigurable:r=!1}=... L156: ${t}`,m_n=Object.getOwnPropertyDescriptor(Function.prototype,"toString"),g_n=Object.getOwnPropertyDescriptor(Function.prototype.toString,"name"),O_n=(e,t,r)=>{let o=r===""?"":`with... L157: `||r==="\r"}#S(){this.#l||(this.#l=setTimeout(()=>{this.#l=void 0,this.isSpinning&&this.#y()},X_n),typeof this.#l?.unref=="function"&&this.#l.unref())}#b(){this.#l&&(clearTimeout(t... L158: `))o+=Math.max(1,Math.ceil(Qce(n)/r));return o}get color(){return this.#f}set color(t){if(t!==void 0&&t!==!1&&!Z_n.has(t))throw new Error("The `color` option must be a valid color ... ... L166: `;case"":case"":case"</

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L155

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/cli.jsView on unpkg

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L153

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L153

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/cli.jsView on unpkg · L1

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L196

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L1

•path = dist/cli.js kind = oversized_source_file sizeBytes = 8004165 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 8004165 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.jsView on unpkg · L1

@softtynet/zplus-worker@1.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code