Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@vantaloom/runtime-darwin-arm64: Suspicious npm security report | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 13 finding(s) warrant review before installing.

View on npm All versions

registry / @vantaloom/runtime-darwin-arm64 / 0.15.9

@vantaloom/runtime-darwin-arm64@0.15.9

⚠ Under review

Vantaloom local runtime for darwin-arm64.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 145 file(s), 3.51 MB of source, external domains: 127.0.0.1, api.github.com, github.com, nextjs.org, react.dev, registry.npmjs.org, registry.npmmirror.com, vanta.timefiles.online, www.apple.com, www.w3.org

Oversized source lightweight scan

web/_next/static/chunks/a9f7b0c6041521a4.js2.49 MB file, sampled 256 KB

Network

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

HighEntropyStrings

Minified

Protestware

Source & flagged code

4 flagged · loading source

web/_next/static/chunks/a97a5cda6e9df469.jsView file

1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,59595,e=>{"use strict";var t=function(e,t){var r=t.next||"start";t.n...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/_next/static/chunks/a97a5cda6e9df469.jsView on unpkg · L1

cli/src/lib/lifecycle.mjsView file

6} from "node:fs" L7: import { spawnSync } from "node:child_process" L8: import os from "node:os" ... L35: try { L36: if (process.platform === "win32") { L37: // A .vbs launches the runtime with a hidden window (no console flash); the ... L61: const launcher = path.join(prefix, "vantaloom") L62: const dir = path.join(os.homedir(), "Library", "LaunchAgents") L63: mkdirSync(dir, { recursive: true }) ... L74: writeFileSync(plistPath, plist) L75: spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore", windowsHide: true }) L76: spawnSync("launchctl", ["load", "-w", plistPath], { stdio: "ignore", windowsHide: true })

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/lib/lifecycle.mjsView on unpkg · L6

web/_next/static/chunks/a9f7b0c6041521a4.jsView file

96contains invisible/control Unicode U+202A (left-to-right embedding) }`;function Qf({open:e,machineId:t,scopedName:n,onOpenChange:r,onInstalled:a}){let[i,o]=eS.useState("local"),[l,s]=eS.useState(""),[c,d]=eS.useState(""),[u,m]=eS.useState(!1),[f,h]=eS.useState(""),[p,g]=eS.useState(null),[x,v]=eS.useState(!

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/_next/static/chunks/a9f7b0c6041521a4.jsView on unpkg · L96

bin/vantaloomctlView file

•path = bin/vantaloomctl kind = native_binary sizeBytes = 5935474 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/vantaloomctlView on unpkg

Findings

1 Critical7 Medium5 Low

CriticalTrojan Source Unicodeweb/_next/static/chunks/a9f7b0c6041521a4.js

MediumDynamic Requireweb/_next/static/chunks/a97a5cda6e9df469.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli/src/lib/lifecycle.mjs

MediumProtestware

MediumShips Native Binarybin/vantaloomctl

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

86%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersfamiglistism

Version0.15.10

PublishedJul 21, 2026

Licensenone

Dependencies0

Integrityverified

Package size75.0 MB

Files264

Runtime surface

package.json

EntrypointsNo public entrypoints declared.

Runtimenode >=20os darwincpu arm64

Artifact121 MB · 264 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsNoLicense

LPM CLI

Source & flagged code

4 flagged

web/_next/static/chunks/a97a5cda6e9df469.jsView file

Lines 1-1javascript

1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,59595,e=>{"use strict";var t=function(e,t){var r=t.next||"start";t.next=t.next;var n=x[r];if(n.splice){for(var o=0;o<n.length;++o){var a=n[o];if(a.regex&&e.match(a.regex))return t.next=a.next||t.next,a.token}return e.next(),"error"}if(e.match(a=x[r])&&a.regex&&e.match(a.regex))return t.next=a.next,a.token;return e.next(),"error"},r="(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*",n=RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|final ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/_next/static/chunks/a97a5cda6e9df469.jsView on unpkg · L1

Long lines were clipped for display.

cli/src/lib/lifecycle.mjsView file

Lines 1-26javascript

1import {

2 existsSync,

3 mkdirSync,

4 rmSync,

5 writeFileSync,

6} from "node:fs"

7import { spawnSync } from "node:child_process"

8import os

web/_next/static/chunks/a9f7b0c6041521a4.jsView file

96contains invisible/control Unicode U+202A (left-to-right embedding) }`;function Qf({open:e,machineId:t,scopedName:n,onOpenChange:r,onInstalled:a}){let[i,o]=eS.useState("local"),[l,s]=eS.useState(""),[c,d]=eS.useState(""),[u,m]=eS.useState(!1),[f,h]=eS.useState(""),[p,g]=eS.useState(null),[x,v]=eS.useState(!

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/_next/static/chunks/a9f7b0c6041521a4.jsView on unpkg · L96

bin/vantaloomctlView file

•path = bin/vantaloomctl kind = native_binary sizeBytes = 5935474 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/vantaloomctlView on unpkg

from

"node:os"

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/lib/lifecycle.mjsView on unpkg · L6

9import path from "node:path"

10import {

11 AUTOSTART_LABEL,

12 WINDOWS_RUN_KEY,

13 WINDOWS_RUN_VALUE,

14} from "./constants.mjs"

15import {

16 binaryName,

17 safeDirectory,

18 defaultPrefix,

19 run,

20 removeKnownPath,

21} from "./platform.mjs"

22import {

23 removeMeshService,

24 killBrowserSidecarProcess,

25 killTrayProcess,

26} from "./legacy-cleanup.mjs"