@vectorx/cloud-agent@1.1.1: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@vectorx/cloud-agent@1.1.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged · loading source

lib/index.jsView file

21L22: `+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZ... L23: `),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:"No answers were provided by the user. This may be because the question p... L24: `),s=x[t(304)](({question:u,answer:d})=>"· "+u+t(291)+d),i=[t(301),...s].join(` L25: `);return{llmContent:a,returnDisplay:{type:t(310),questions:e,answers:x,displayText:i}}},approval:{category:"ask",needsApproval:()=>!0}})}function kt(){const n=["BNvTyMvY","mti5mJi... L26:

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

lib/index.jsView on unpkg · L21

13Trigger-reachable chain: manifest.main -> lib/index.js L13: </directory_structure>`}return t}[q0(546)](e){const x=q0;return`<files>This section contains the contents of the repository's files. L14: `+e[x(485)](a=>!Ca.has(p[x(531)](a.filePath).toLowerCase())).map(a=>{const s=x,i=m[s(534)](a[s(514)]);if(i.size>Ga)return{content:"// File too large to display",metadata:s(491)+Mat... L15: <metadata>`+a.metadata+`</metadata> ... L21: L22: `+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZ... L23: `),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:"No answers were provided by the user. This may be because the que

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/index.jsView on unpkg · L13

1"use strict";var oa=Object.create;var ln=Object.defineProperty,ia=Object.defineProperties,ca=Object.getOwnPropertyDescriptor,fa=Object.getOwnPropertyDescriptors,ua=Object.getOwnPro... L2: `+t.whenToUse).join(`

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L1

13</directory_structure>`}return t}[q0(546)](e){const x=q0;return`<files>This section contains the contents of the repository's files. L14: `+e[x(485)](a=>!Ca.has(p[x(531)](a.filePath).toLowerCase())).map(a=>{const s=x,i=m[s(534)](a[s(514)]);if(i.size>Ga)return{content:"// File too large to display",metadata:s(491)+Mat... L15: <metadata>`+a.metadata+`</metadata> ... L21: L22: `+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZ... L23: `),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:"No answers were provided by the user. This may be because the question p... L24: `),s=x[t(304)](({question:u,answer:d})=

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/index.jsView on unpkg · L13

13Trigger-reachable command-output exfiltration chain: manifest.main -> lib/index.js L13: </directory_structure>`}return t}[q0(546)](e){const x=q0;return`<files>This section contains the contents of the repository's files. L14: `+e[x(485)](a=>!Ca.has(p[x(531)](a.filePath).toLowerCase())).map(a=>{const s=x,i=m[s(534)](a[s(514)]);if(i.size>Ga)return{content:"// File too large to display",metadata:s(491)+Mat... L15: <metadata>`+a.metadata+`</metadata> ... L21: L22: `+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZ... L23: `),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:"No answers were provided by the user.

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/index.jsView on unpkg · L13

Source & flagged code

5 flagged

lib/index.jsView file

Lines 1-41javascript

1"use strict";var oa=Object.create;var ln=Object.defineProperty,ia=Object.defineProperties,ca=Object.getOwnPropertyDescriptor,fa=Object.getOwnPropertyDescriptors,ua=Object.getOwnPropertyNames,Dt=Object.getOwnPropertySymbols,la=Object.getPrototypeOf,dn=Object.prototype.hasOwnProperty,tr=Object.prototype.propertyIsEnumerable;var $n=(n,e)=>(e=Symbol[n])?e:Symbol.for("Symbol."+n),er=n=>{throw TypeError(n)};var xr=(n,e,x)=>e in n?ln(n,e,{enumerable:!0,configurable:!0,writable:!0,value:x}):n[e]=x,y=(n,e)=>{for(var x in e||(e={}))dn.call(e,x)&&xr(n,x,e[x]);if(Dt)for(var x of Dt(e))tr.call(e,x)&&xr(n,x ...

2`+t.whenToUse).join(`

High

Child Process

Package source references child process execution.

lib/index.jsView on unpkg · L1

3

4`)}}function V0(n,e){n=n-320;const x=qt();let t=x[n];if(V0.sfcPro===void 0){var r=function(u){const d="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";let l="",h="";for(let o=0,f,c,g=0;c=u.charAt(g++);~c&&(f=o%4?f*64+c:c,o++%4)?l+=String.fromCharCode(255&f>>(-2*o&6)):0)c=d.indexOf(c);for(let o=0,f=l.length;o<f;o++)h+="%"+("00"+l.charCodeAt(o).toString(16)).slice(-2);return decodeURIComponent(h)};V0.RRADMS=r,V0.lozjEh={},V0.sfcPro=!0}const a=x[0],s=n+a,i=V0.lozjEh[s];return i?t=i:(t=V0.RRADMS(t),V0.lozjEh[s]=t),t}const Q=V0;(function(n,e){const x=V0,t=n();for(;;)try{if(parseI ...

5`),t=[],r=[];for(const a of x){const s=a[e(126)]();if(!(!s||s.startsWith("#"))){if(s[

6`,t=" ");for(const s of e)a+=t+"- "+s[r(410)]+(s[r(406)]===r(414)?p.sep:"")+`

7`,s.children&&s.children.length>0&&(a+=Gr(n,s.children,x+1,t+" "));return a}const q0=C0;function C0(n,e){n=n-476;const x=Tt();let t=x[n];if(C0.lNilMy===void 0){var r=function(u){const d="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=";let l="",h="";for(let o=0,f,c,g=0;c=u.charAt(g++);~c&&(f=o%4?f*64+c:c,o++%4)?l+=String.fromCharCode(255&f>>(-2*o&6)):0)c=d.indexOf(c);for(let o=0,f=l.length;o<f;o++)h+="%"+("00"+l.charCodeAt(o).toString(16)).slice(-2);return decodeURIComponent(h)};C0.GUAmdd=r,C0.lRVLOn={},C0.lNilMy=!0}const a=x[0],s=n+a,i=C0.lRVLOn[s];return i?t=i:(t=C0.GUAmdd ...

8

9`+i+`

10</directory_structure>`}catch(a){t+=`

11<directory_structure path="`+p.relative(this[x(520)],r)+`">

12Error: Unable to read directory

13</directory_structure>`}return t}[q0(546)](e){const x=q0;return`<files>This section contains the contents of the repository's files.

14`+e[x(485)](a=>!Ca.has(p[x(531)](a.filePath).toLowerCase())).map(a=>{const s=x,i=m[s(534)](a[s

15 <metadata>`+a.metadata+`</metadata>

16 <content><![CDATA[`+a.content+`]]></content>

17 </file>`).join("")+x(487)}[q0(490)](e){const x=[],t=r=>{const a=C0;try{const s=m[a

18`),metadata:w+" of "+a+" total lines"}}return a<=bn?{content:r[t(545)](d=>this[t(538)](d)).join(`

19`),metadata:t(537)+a+" lines)"}:{content:r.slice(0,bn)[t(545)](u=>this.truncateLine(u)).join(`

20`),metadata:t(515)+bn+t(501)+a+" total lines"}}static[q0(484)](e){const x=q0,t=[...e[x(526)]].reverse()[x(489)](a=>{const s=x;return s(507)in a&&a[s(507)]==="user"});if(!t)return e[x(526)];const r=t.content;for(const a of r)if(a[x(480)]==="text"){const s=a.text,i=new Zn({userPrompt:s,cwd:e[x(520)]}),u=i.getContent();u&&(a[x(517)]+=`

21

22`+u)}return e.input}}function Nt(){const n=["nZCWwKHKExjL","zMLYC3q","C2vYAwvZtwvYz2u","C2vYAwvZtgfZDa","u2vYAwvZtwvYz2u","mZCWBKnfuen5","zMLSDgvY","zNvUy3rPB24","C2vYAwvZ","otKWmZC0AwzmuNb1","u2vYAwvZ","yxbWBhK","oujLr2Dvva","zw5MB3jJzq","ugfYywXSzwW","CgfYywXSzwW","nJy1odntvfzerLm","y29Uy2f0","mZe4m0Xvuu1krG","mJi1nJi0yKr4EvHf","nJaYmZjZquXothq","mZaYnZiYD1bQvgnv","BwfW","mta4AhPZCgjO","nZK1mtbVywjXr2O","sw52ywXPzcbOB29Rihr5Cgu6ia"];return Nt=function(){return n},Nt()}const wn=_0;(function(n,e){const x=_0,t=n();for(;;)try{if(-parseInt(x(322))/1+-parseInt(x(306))/2*(-parseInt(x(319))/3)+-pars ...

23`),parameters:Ka,execute:async({questions:e,answers:x})=>{const t=n;if(!x||x[t(309)]===0)return{llmContent:

24`),s=x[t(304)](({question:u,answer:d})=>"· "+u+t(291)+d),i=[t(301),...

25`);return{llmContent:a,returnDisplay:{type:t(310),questions:e,answers:x,displayText:i}}},approval:{category:"ask",needsApproval:()=>!0}})}function kt(){const n=["BNvTyMvY","mti5mJi2rMjtufPY","uhjVy2vZCYbLEgL0zwqGD2L0AcbJB2rLia","cGPBq29TBwfUzcb0Aw1LzcbVDxqGywz0zxiG","ndC3s1z3q1H3",

26

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

lib/index.jsView on unpkg · L21

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/index.jsView on unpkg · L13

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

lib/index.jsView on unpkg · L13

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

lib/index.jsView on unpkg · L13

27...[truncated]`:o||i(406);return l.error&&!l.timedOut?{isError:!0,llmContent:"Command failed: "+l.error.message+`

28

29Output:

30`+f,returnDisplay:f}:l.timedOut?{isError:!0,llmContent:i(404)+u/1e3+`s.

31

32Partial output:

33`+f,returnDisplay:f}:{llmContent:f,returnDisplay:f}}})}(function(n,e){const x=W,t=n();for(;;)try{if(-parseInt(x(428))/1*(-parseInt(x(435))/2)+-parseInt(x(445))/3*(parseInt(x(432))/4)+-parseInt(x(434))/5+-parseInt(x(419))/6*(parseInt(x(425))/7)+parseInt(x(447))/8+parseInt(x(446))/9*(parseInt(x(439))/10)+parseInt(x(438))/11===e)break;t.push(t.shift())}catch(r){t.push(t.shift())}})(Ot,675811);function Ot(){const n=["t3jPz2LUywWGyw5KigvKAxrLzcbMAwXLig1HDgnOigv4ywn0BhKUiezHAwXLzcb0BYbHChbSEsbLzgL0lG","Aw5KzxHpzG","DxrMltG","u3rYAw5Nig5VDcbMB3vUzcbPBIbMAwXLlIbgywLSzwqGDg8GyxbWBhKGzwrPDc4ku3rYAw5NoIa ...

34`),r=e[x(444)](`

35`),a=[];for(let s=0;s<=t[x(448)]-r.length;s++){let i=!0;for(let u=0;u<r[x(448)];u++

36`))}}return a[x(448)]===1?a[0]:null}function Xa(n,e){const x=W,t=.5,r=.3

37`),s=e[x(444)](`

38`);if(s.length<3)return null;const i=s[0].trim(),u=s[s.length-1].trim(),d=[];for(let

39`):null}let h=null,o=-1;for(const f of d){const c=l(f);c>o&&c>=r&&(o=

40`))}return h}function Va(n,e){const x=W,t=u=>u.replace(/\s+/g," ").trim(),r

41`),s=[];for(const u of a)t(u)===r&&s[x(441)](u);if(s.length===1)return s[0];const i

Long lines were clipped for display.