Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

@vantaloom/runtime-darwin-arm64@0.14.21: Clean npm security | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Passed — safe to install

No malicious behavior detected. 13 low-signal pattern(s) reviewed.

View on npm All versions

registry / @vantaloom/runtime-darwin-arm64 / 0.14.21

@vantaloom/runtime-darwin-arm64@0.14.21

Vantaloom local runtime for darwin-arm64.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 143 file(s), 3.14 MB of source, external domains: 127.0.0.1, api.github.com, github.com, nextjs.org, react.dev, registry.npmjs.org, registry.npmmirror.com, vanta.timefiles.online, www.apple.com, www.w3.org

Oversized source lightweight scan

web/_next/static/chunks/2f66cb0694248d00.js2.28 MB file, sampled 256 KB

Network

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

HighEntropyStrings

Minified

Protestware

Source & flagged code

4 flagged · loading source

web/_next/static/chunks/a97a5cda6e9df469.jsView file

1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,59595,e=>{"use strict";var t=function(e,t){var r=t.next||"start";t.n...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/_next/static/chunks/a97a5cda6e9df469.jsView on unpkg · L1

cli/src/lib/lifecycle.mjsView file

6} from "node:fs" L7: import { spawnSync } from "node:child_process" L8: import os from "node:os" ... L34: try { L35: if (process.platform === "win32") { L36: // A .vbs launches the runtime with a hidden window (no console flash); the ... L60: const launcher = path.join(prefix, "vantaloom") L61: const dir = path.join(os.homedir(), "Library", "LaunchAgents") L62: mkdirSync(dir, { recursive: true }) ... L73: writeFileSync(plistPath, plist) L74: spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore", windowsHide: true }) L75: spawnSync("launchctl", ["load", "-w", plistPath], { stdio: "ignore", windowsHide: true })

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/lib/lifecycle.mjsView on unpkg · L6

bin/vantaloomctlView file

•path = bin/vantaloomctl kind = native_binary sizeBytes = 5935330 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/vantaloomctlView on unpkg

web/_next/static/chunks/2f66cb0694248d00.jsView file

•path = web/_next/static/chunks/2f66cb0694248d00.js kind = oversized_source_file sizeBytes = 2386153 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

web/_next/static/chunks/2f66cb0694248d00.jsView on unpkg

Findings

1 High7 Medium5 Low

HighOversized Source Fileweb/_next/static/chunks/2f66cb0694248d00.js

MediumDynamic Requireweb/_next/static/chunks/a97a5cda6e9df469.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli/src/lib/lifecycle.mjs

MediumProtestware

MediumShips Native Binarybin/vantaloomctl

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

65%Pass

Verdict confidence

Firewall policyNo policy match

Package metadata

npm

Maintainersfamiglistism

Version0.15.10

PublishedJul 16, 2026

Licensenone

Dependencies0

Integrityverified

Package size120 MB

Files204

Runtime surface

package.json

EntrypointsNo public entrypoints declared.

Runtimenode >=20os darwincpu arm64

Artifact250 MB · 204 files1 signature(s)

Install lifecycleNo scripts declared.

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsMinifiedObfuscatedProtestwareUrlStringsNoLicense

LPM CLI

Source & flagged code

4 flagged

web/_next/static/chunks/a97a5cda6e9df469.jsView file

Lines 1-1javascript

1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,59595,e=>{"use strict";var t=function(e,t){var r=t.next||"start";t.next=t.next;var n=x[r];if(n.splice){for(var o=0;o<n.length;++o){var a=n[o];if(a.regex&&e.match(a.regex))return t.next=a.next||t.next,a.token}return e.next(),"error"}if(e.match(a=x[r])&&a.regex&&e.match(a.regex))return t.next=a.next,a.token;return e.next(),"error"},r="(?![\\d\\s])[$\\w\\xAA-\\uFFDC](?:(?!\\s)[$\\w\\xAA-\\uFFDC]|-[A-Za-z])*",n=RegExp("(?:[({[=:]|[-~]>|\\b(?:e(?:lse|xport)|d(?:o|efault)|t(?:ry|hen)|final ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/_next/static/chunks/a97a5cda6e9df469.jsView on unpkg · L1

Long lines were clipped for display.

cli/src/lib/lifecycle.mjsView file

Lines 1-26javascript

1import {

2 existsSync,

3 mkdirSync,

4 rmSync,

5 writeFileSync,

6} from "node:fs"

7import { spawnSync } from "node:child_process"

8import os

bin/vantaloomctlView file

•path = bin/vantaloomctl kind = native_binary sizeBytes = 5935330 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/vantaloomctlView on unpkg

web/_next/static/chunks/2f66cb0694248d00.jsView file

•path = web/_next/static/chunks/2f66cb0694248d00.js kind = oversized_source_file sizeBytes = 2386153 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

web/_next/static/chunks/2f66cb0694248d00.jsView on unpkg

from

"node:os"

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/lib/lifecycle.mjsView on unpkg · L6

9import path from "node:path"

10import {

11 AUTOSTART_LABEL,

12 WINDOWS_RUN_KEY,

13 WINDOWS_RUN_VALUE,

14} from "./constants.mjs"

15import {

16 binaryName,

17 safeDirectory,

18 defaultPrefix,

19 run,

20 removeKnownPath,

21} from "./platform.mjs"

22import {

23 removeMeshService,

24 killTrayProcess,

25} from "./legacy-cleanup.mjs"

26