@trungtamcongnghedigital/vsaf@1.3.3: Suspicious npm security | LPM Firewall

Loading npm security reports…

@trungtamcongnghedigital/vsaf@1.3.3: Suspicious npm security | LPM Firewall

Source & flagged code

27 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView file

194patternName = aws_access_key severity = critical line = 194

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

194patternName = aws_access_key severity = critical line = 194

Critical

Secret Pattern

AWS access key ID in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L194

195patternName = github_pat severity = critical line = 195

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

skills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.pyView on unpkg · L195

packages/core/dist/isolation/workspace-manager.jsView file

7const crypto_1 = require("crypto"); L8: const child_process_1 = require("child_process"); L9: const util_1 = require("util");

High

Child Process

Package source references child process execution.

packages/core/dist/isolation/workspace-manager.jsView on unpkg · L7

scripts/postinstall.cjsView file

23L24: const fs = require('fs'); L25: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/postinstall.cjsView on unpkg · L23

scripts/fetch-autotest-upstream.mjsView file

11const REF = 'refs/heads/master'; L12: const BB = (process.env.VDS_BITBUCKET_URL || 'http://bitbucket.digital.vn').replace(/\/+$/, ''); L13: const TOKEN = process.env.BITBUCKET_ACCESS_TOKEN; ... L18: const API = `${BB}/rest/api/1.0/projects/AUT/repos/rf-agentskills`; L19: const OUT = join(process.cwd(), 'skills', 'autotest-skill'); L20: ... L35: if (!res.ok) throw new Error(`HTTP ${res.status} khi tải ${path}`); L36: return asText ? res.text() : Buffer.from(await res.arrayBuffer()); L37: }

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

scripts/fetch-autotest-upstream.mjsView on unpkg · L11

skills/sdlc/install-deps.mjsView file

14* 2. Checks/installs npm package: gitnexus (includes MCP server built-in) L15: * 3. Provisions .mcp.json with GitNexus MCP server entry (npx gitnexus mcp) L16: */ ... L19: import { join } from 'path'; L20: import { execSync } from 'child_process'; L21:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

skills/sdlc/install-deps.mjsView on unpkg · L14

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = skills/sdlc/install-deps.mjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/sdlc/install-deps.mjsView on unpkg

skills/vds-skill/search-confluence/scripts/search.shView file

•path = skills/vds-skill/search-confluence/scripts/search.sh kind = build_helper sizeBytes = 4624 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/vds-skill/search-confluence/scripts/search.shView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView file

•path = skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf kind = high_entropy_blob sizeBytes = 40986 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdfView on unpkg

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView file

•path = skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py kind = payload_in_excluded_dir sizeBytes = 3413 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.pyView on unpkg

packages/cli/dist/commands/init.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 9

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

packages/cli/dist/commands/init.js#virtual:normalized:round1View on unpkg

packages/core/dist/engine/node-runner.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = packages/core/dist/engine/node-runner.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/core/dist/engine/node-runner.jsView on unpkg

packages/cli/dist/commands/install/bootstrap-repo.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-repo.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/install/bootstrap-repo.jsView on unpkg

packages/cli/dist/commands/serve.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/serve.jsView on unpkg

packages/cli/dist/commands/telemetry-skill.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-skill.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/commands/telemetry-skill.jsView on unpkg

skills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-driver-hooks.cjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjsView on unpkg

skills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted]-agy-driver.cjs matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjsView on unpkg

packages/cli/dist/server/routes/workflows.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = [redacted].js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/routes/workflows.jsView on unpkg

packages/cli/dist/server/static.jsView file

•matchType = normalized_sha256 matchedPackage = @trungtamcongnghedigital/vsaf@1.1.0 matchedPath = packages/cli/dist/server/static.js matchedIdentity = npm:[redacted]:1.1.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

packages/cli/dist/server/static.jsView on unpkg

packages/cli/dist/commands/doctor.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trungtamcongnghedigital/vsaf@1.2.0 matchedIdentity = npm:[redacted]:1.2.0 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/cli/dist/commands/doctor.jsView on unpkg

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView file

7patternName = generic_password severity = medium line = 7

Medium

Secret Pattern

Hardcoded password in skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.yml

skills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.ymlView on unpkg · L7

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView file

132patternName = github_pat severity = critical line = 132

Critical

Secret Pattern

GitHub personal access token in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L132

136patternName = stripe_live_secret severity = critical line = 136

Critical

Secret Pattern

Stripe live secret key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L136

135patternName = google_api_key severity = high line = 135

High

Secret Pattern

Google API key in skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

skills/vds-skill/vds-scripts/scripts/dev/cli_smoke.shView on unpkg · L135

Findings

6 Critical18 High7 Medium5 Low

CriticalCritical Secretskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalPrevious Version Dangerous Deltapackages/cli/dist/commands/doctor.js

CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/tests/conftest.py

CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

CriticalSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpackages/core/dist/isolation/workspace-manager.js

HighShell

HighRemote System File Writescripts/fetch-autotest-upstream.mjs

HighRuntime Package Installskills/sdlc/install-deps.mjs

HighShips High Entropy Blobskills/vds-skill/vds-scripts/pdf_orchestrator/cli_verification_test/test.pdf

HighPayload In Excluded Dirskills/vds-skill/vds-scripts/vds_cli/tests/unit/test_cli_DOC004.py

HighSemantic Analysis Limitedpackages/cli/dist/commands/init.js#virtual:normalized:round1

HighKnown Malware Source Similaritypackages/core/dist/engine/node-runner.js

HighKnown Malware Source Similaritypackages/cli/dist/commands/install/bootstrap-repo.js

HighKnown Malware Source Similaritypackages/cli/dist/commands/serve.js

HighKnown Malware Source Similaritypackages/cli/dist/commands/telemetry-skill.js

HighKnown Malware Source Similarityskills/NTAPP/scripts/antigravity/hooks/test-driver-hooks.cjs

HighKnown Malware Source Similarityskills/NTAPP/scripts/antigravity/vsaf-agy-driver.cjs

HighKnown Malware Source Similarityskills/sdlc/install-deps.mjs

HighKnown Malware Source Similaritypackages/cli/dist/server/routes/workflows.js

HighKnown Malware Source Similaritypackages/cli/dist/server/static.js

HighSecret Patternskills/vds-skill/vds-scripts/scripts/dev/cli_smoke.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/postinstall.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperskills/vds-skill/search-confluence/scripts/search.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/vds-skill/vds-scripts/pdf_orchestrator/config/alertmanager.yml

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings