@vantaloom/runtime-darwin-arm64@0.15.1: Clean npm security report | LPM Firewall

Loading npm security reports…

@vantaloom/runtime-darwin-arm64@0.15.1: Clean npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

web/_next/static/chunks/a97a5cda6e9df469.jsView file

1(globalThis.TURBOPACK||(globalThis.TURBOPACK=[])).push(["object"==typeof document?document.currentScript:void 0,59595,e=>{"use strict";var t=function(e,t){var r=t.next||"start";t.n...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

web/_next/static/chunks/a97a5cda6e9df469.jsView on unpkg · L1

cli/src/lib/lifecycle.mjsView file

6} from "node:fs" L7: import { spawnSync } from "node:child_process" L8: import os from "node:os" ... L35: try { L36: if (process.platform === "win32") { L37: // A .vbs launches the runtime with a hidden window (no console flash); the ... L61: const launcher = path.join(prefix, "vantaloom") L62: const dir = path.join(os.homedir(), "Library", "LaunchAgents") L63: mkdirSync(dir, { recursive: true }) ... L74: writeFileSync(plistPath, plist) L75: spawnSync("launchctl", ["unload", plistPath], { stdio: "ignore", windowsHide: true }) L76: spawnSync("launchctl", ["load", "-w", plistPath], { stdio: "ignore", windowsHide: true })

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/lib/lifecycle.mjsView on unpkg · L6

bin/vantaloomctlView file

•path = bin/vantaloomctl kind = native_binary sizeBytes = 5935474 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/vantaloomctlView on unpkg

web/_next/static/media/KaTeX_Size4-Regular.b211e3d3.woffView file

•path = web/_next/static/media/KaTeX_Size4-Regular.b211e3d3.woff kind = high_entropy_blob sizeBytes = 5980 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/_next/static/media/KaTeX_Size4-Regular.b211e3d3.woffView on unpkg

web/_next/static/chunks/f203d110bee7e006.jsView file

•path = web/_next/static/chunks/f203d110bee7e006.js kind = oversized_source_file sizeBytes = 2571137 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

web/_next/static/chunks/f203d110bee7e006.jsView on unpkg

web/_next/static/chunks/0c7fdf9979ab480b.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vantaloom/runtime-darwin-arm64@0.14.32 matchedIdentity = npm:[redacted]:0.14.32 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

web/_next/static/chunks/0c7fdf9979ab480b.jsView on unpkg