@vibelet/cli@1.2.163: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@vibelet/cli@1.2.163: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/web/assets/cobol-nwyudZeR.jsView file

1import e from"./html-GMplVEZG.js";import n from"./java-CylS5w8V.js";import"./javascript-wDzz0qaB.js";import"./css-DPfMkruS.js";const t=Object.freeze(JSON.parse(`{"displayName":"COB...

High

Child Process

Package source references child process execution.

dist/web/assets/cobol-nwyudZeR.jsView on unpkg · L1

dist/vibelet.mjsView file

•A module-load call serializes the broad process environment, working directory, and command-line arguments and posts them to a literal external destination. dist/vibelet.mjs: if (!process.env.WS_NO_BUFFER_UTIL) { * This provides methods for emulating the `EventTarget` interface. It's not this._inflate.write(data); if (fin) this._inflate.write(TRAILER); if (this._inflate._readableState.endEmitted) { this._deflate.write(data); this.end(); this.end();

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/vibelet.mjsView on unpkg

105Trigger-reachable persistence chain: manifest.bin -> dist/vibelet.mjs L105: } else { L106: buf = Buffer.from(data); L107: toBuffer.readOnly = false; ... L121: /* istanbul ignore else */ L122: if (!process.env.WS_NO_BUFFER_UTIL) { L123: try { ... L161: kStatusCode: Symbol('status-code'), L162: kWebSocket: Symbol('websocket'), L163: NOOP: () => {} ... L375: const event = new MessageEvent('message', { L376: data: isBinary ? data : data.toString() L377: });

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/vibelet.mjsView on unpkg · L105

105} else { L106: buf = Buffer.from(data); L107: toBuffer.readOnly = false; ... L121: /* istanbul ignore else */ L122: if (!process.env.WS_NO_BUFFER_UTIL) { L123: try { ... L161: kStatusCode: Symbol('status-code'), L162: kWebSocket: Symbol('websocket'), L163: NOOP: () => {} ... L375: const event = new MessageEvent('message', { L376: data: isBinary ? data : data.toString() L377: });

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/vibelet.mjsView on unpkg · L105

11101L11102: module.exports = eval("require")("bufferutil"); L11103:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vibelet.mjsView on unpkg · L11101

dist/web/assets/codeql-DsOJ9woJ.jsView file

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibelet/cli@1.2.154 matchedIdentity = npm:QHZpYmVsZXQvY2xp:1.2.154 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

1'use strict';const _0x2290e5=_0x35bb;(function(_0x2c0953,_0x4956bf){const _0x11e0ad=_0x35bb,_0x1fd1a8=_0x2c0953();while(!![]){try{const _0x52e800=-parseInt(_0x11e0ad(0x4fa))/0x1+pa...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

1'use strict';const _0x2290e5=_0x35bb;(function(_0x2c0953,_0x4956bf){const _0x11e0ad=_0x35bb,_0x1fd1a8=_0x2c0953();while(!![]){try{const _0x52e800=-parseInt(_0x11e0ad(0x4fa))/0x1+pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1

Source & flagged code

9 flagged

dist/web/assets/cobol-nwyudZeR.jsView file

Lines 1-2javascript

1import e from"./html-GMplVEZG.js";import n from"./java-CylS5w8V.js";import"./javascript-wDzz0qaB.js";import"./css-DPfMkruS.js";const t=Object.freeze(JSON.parse(`{"displayName":"COBOL","fileTypes":["ccp","scbl","cobol","cbl","cblle","cblsrce","cblcpy","lks","pdv","cpy","copybook","cobcopy","fd","sel","scb","scbl","sqlcblle","cob","dds","def","src","ss","wks","bib","pco"],"name":"cobol","patterns":[{"match":"^([ *][ *][ *][ *][ *][ *])([Dd]\\\\s.*)$","name":"token.info-token.cobol"},{"captures":{"1":{"name":"constant.numeric.cobol"},"2":{"name":"comment.line.cobol.newpage"}},"match":"^([ *][ *][ ...

High

Child Process

Package source references child process execution.

dist/web/assets/cobol-nwyudZeR.jsView on unpkg · L1

2

Long lines were clipped for display.

dist/vibelet.mjsView file

Lines 85-125javascript

85

86/**

87 * Converts `data` to a `Buffer`.

88 *

89 * @param {*} data The data to convert

90 * @return {Buffer} The buffer

91 * @throws {TypeError}

dist/web/assets/codeql-DsOJ9woJ.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywo ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibelet/cli@1.2.154 matchedIdentity = npm:QHZpYmVsZXQvY2xp:1.2.154 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.cjsView on unpkg

1'use strict';const _0x2290e5=_0x35bb;(function(_0x2c0953,_0x4956bf){const _0x11e0ad=_0x35bb,_0x1fd1a8=_0x2c0953();while(!![]){try{const _0x52e800=-parseInt(_0x11e0ad(0x4fa))/0x1+pa...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.cjsView on unpkg · L1

1'use strict';const _0x2290e5=_0x35bb;(function(_0x2c0953,_0x4956bf){const _0x11e0ad=_0x35bb,_0x1fd1a8=_0x2c0953();while(!![]){try{const _0x52e800=-parseInt(_0x11e0ad(0x4fa))/0x1+pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1