@vibelet/cli@1.2.176: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@vibelet/cli@1.2.176: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/vibelet.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vibelet/cli@1.2.169 matchedIdentity = npm:QHZpYmVsZXQvY2xp:1.2.169 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/vibelet.mjsView on unpkg

20Trigger-reachable persistence chain: manifest.bin -> dist/vibelet.mjs L20: * L21: * http://www.opensource.org/licenses/mit-license.php L22: * ... L1769: // add binary data sequence to buffer L1770: data.write(buffer) L1771: }) ... L2832: if (err) cb(err) L2833: let url = 'data:image/png;base64,' L2834: url += output.toString('base64') ... L6266: /* istanbul ignore else */ L6267: if (!process.env.WS_NO_BUFFER_UTIL) { L6268: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/vibelet.mjsView on unpkg · L20

20* L21: * http://www.opensource.org/licenses/mit-license.php L22: * ... L1769: // add binary data sequence to buffer L1770: data.write(buffer) L1771: }) ... L2832: if (err) cb(err) L2833: let url = 'data:image/png;base64,' L2834: url += output.toString('base64') ... L6266: /* istanbul ignore else */ L6267: if (!process.env.WS_NO_BUFFER_UTIL) { L6268: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/vibelet.mjsView on unpkg · L20

11182L11183: module.exports = eval("require")("bufferutil"); L11184:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vibelet.mjsView on unpkg · L11182

dist/web/assets/codeql-DsOJ9woJ.jsView file

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/assets/codeql-DsOJ9woJ.jsView on unpkg · L1

dist/index.cjsView file

1'use strict';const _0x2d0581=_0x2db9;(function(_0x1d0631,_0x24690d){const _0x142e41=_0x2db9,_0x328f58=_0x1d0631();while(!![]){try{const _0x36418c=parseInt(_0x142e41(0xc1d))/0x1+-pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1

Source & flagged code

6 flagged

dist/vibelet.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2import { createRequire as __WEBPACK_EXTERNAL_createRequire } from "module";

3/******/ var __webpack_modules__ = ({

4

5/***/ 1635:

6/***/ ((module) => {

7

8

9

10/******************************************************************************

11 * Created 2008-08-19.

12 *

13 * Dijkstra path-finding functions. Adapted from the Dijkstar Python project.

14 *

15 * Copyright (C) 2008

16 * Wyatt Baldwin <self@wyattbaldwin.com>

17 * All rights reserved

18 *

19 * Licensed under the MIT license.

20 *

21 * http://www.opensource.org/licenses/mit-license.php

22 *

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/vibelet.mjsView on unpkg · L20

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/vibelet.mjsView on unpkg · L20

23 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR

24 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

25 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE

26 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER

27 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

28 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN

29 * THE SOFTWARE.

30 *****************************************************************************/

31var dijkstra = {

32 single_source_shortest_paths: function(graph, s, d) {

33 // Predecessor map for each node that has been encountered.

34 // node ID => predecessor node ID

35 var predecessors = {};

36

37 // Costs of shortest paths from s to all nodes encountered.

38 // node ID => cost

39 var costs = {};

40 costs[s] = 0;

Lines 11162-11202javascript

11162 *

11163 * @private

11164 */

11165function socketOnError() {

11166 const websocket = this[kWebSocket];

11167

11168 this.

•matchType = previous_version_dangerous_delta matchedPackage = @vibelet/cli@1.2.169 matchedIdentity = npm:QHZpYmVsZXQvY2xp:1.2.169 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/vibelet.mjsView on unpkg

dist/web/assets/codeql-DsOJ9woJ.jsView file

Lines 1-2javascript

1const e=Object.freeze(JSON.parse('{"displayName":"CodeQL","fileTypes":["ql","qll"],"name":"codeql","patterns":[{"include":"#module-member"}],"repository":{"abstract":{"match":"\\\\babstract(?![0-9A-Z_a-z])","name":"storage.modifier.abstract.ql"},"additional":{"match":"\\\\badditional(?![0-9A-Z_a-z])","name":"storage.modifier.additional.ql"},"and":{"match":"\\\\band(?![0-9A-Z_a-z])","name":"keyword.other.and.ql"},"annotation":{"patterns":[{"include":"#bindingset-annotation"},{"include":"#language-annotation"},{"include":"#pragma-annotation"},{"include":"#annotation-keyword"}]},"annotation-keywo ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.cjsView file

1'use strict';const _0x2d0581=_0x2db9;(function(_0x1d0631,_0x24690d){const _0x142e41=_0x2db9,_0x328f58=_0x1d0631();while(!![]){try{const _0x36418c=parseInt(_0x142e41(0xc1d))/0x1+-pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.cjsView on unpkg · L1