@wagemule/daemon@0.1.67: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@wagemule/daemon@0.1.67: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/main.cjsView file

7377var import_node_fs8 = require("node:fs"); L7378: var import_node_child_process11 = require("node:child_process"); L7379: var import_node_path30 = __toESM(require("node:path"));

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L7377

18763const impl = this.options.execFileImpl ?? import_node_child_process4.execFile; L18764: const execAsync = (0, import_node_util.promisify)(impl); L18765: const result = await execAsync(command, args, { timeout: timeoutMs, cwd: this.homedir() });

High

Shell

Package source references shell execution.

dist/main.cjsView on unpkg · L18763

7377var import_node_fs8 = require("node:fs"); L7378: var import_node_child_process11 = require("node:child_process"); L7379: var import_node_path30 = __toESM(require("node:path")); L7380: var import_promises28 = require("node:fs/promises"); L7381: var import_node_http2 = require("node:http"); L7382: ... L7388: cwd: spec.cwd, L7389: env: spec.env ?? process.env, L7390: stdio: ["ignore", "pipe", "pipe"]

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.cjsView on unpkg · L7377

8var __hasOwnProp = Object.prototype.hasOwnProperty; L9: var __commonJS = (cb, mod) => function __require() { L10: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.cjsView on unpkg · L8

2604if (typeof node_buffer.Buffer === "function") { L2605: return node_buffer.Buffer.from(src, "base64"); L2606: } else if (typeof atob === "function") { ... L5217: yield* this.next(token); L5218: yield* this.end(forceDoc, endOffset); L5219: } ... L5221: *next(token) { L5222: if (node_process.env.LOG_STREAM) L5223: console.dir(token, { depth: null }); ... L7377: var import_node_fs8 = require("node:fs"); L7378: var import_node_child_process11 = require("node:child_process"); L7379: var import_node_path30 = __toESM(require("node:path"));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main.cjsView on unpkg · L2604

17478if (!this.inquirerPromise) { L17479: const dynamicImport = new Function( L17480: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/main.cjsView on unpkg · L17478

container/build-runtime-image.shView file

•path = container/build-runtime-image.sh kind = build_helper sizeBytes = 2982 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

container/build-runtime-image.shView on unpkg

Source & flagged code

7 flagged

dist/main.cjsView file

7377var import_node_fs8 = require("node:fs"); L7378: var import_node_child_process11 = require("node:child_process"); L7379: var import_node_path30 = __toESM(require("node:path"));

High

Child Process

Package source references child process execution.

dist/main.cjsView on unpkg · L7377

18763const impl = this.options.execFileImpl ?? import_node_child_process4.execFile; L18764: const execAsync = (0, import_node_util.promisify)(impl); L18765: const result = await execAsync(command, args, { timeout: timeoutMs, cwd: this.homedir() });

High

Shell

Package source references shell execution.

dist/main.cjsView on unpkg · L18763

7377var import_node_fs8 = require("node:fs"); L7378: var import_node_child_process11 = require("node:child_process"); L7379: var import_node_path30 = __toESM(require("node:path")); L7380: var import_promises28 = require("node:fs/promises"); L7381: var import_node_http2 = require("node:http"); L7382: ... L7388: cwd: spec.cwd, L7389: env: spec.env ?? process.env, L7390: stdio: ["ignore", "pipe", "pipe"]

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/main.cjsView on unpkg · L7377

8var __hasOwnProp = Object.prototype.hasOwnProperty; L9: var __commonJS = (cb, mod) => function __require() { L10: return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/main.cjsView on unpkg · L8

2604if (typeof node_buffer.Buffer === "function") { L2605: return node_buffer.Buffer.from(src, "base64"); L2606: } else if (typeof atob === "function") { ... L5217: yield* this.next(token); L5218: yield* this.end(forceDoc, endOffset); L5219: } ... L5221: *next(token) { L5222: if (node_process.env.LOG_STREAM) L5223: console.dir(token, { depth: null }); ... L7377: var import_node_fs8 = require("node:fs"); L7378: var import_node_child_process11 = require("node:child_process"); L7379: var import_node_path30 = __toESM(require("node:path"));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/main.cjsView on unpkg · L2604

17478if (!this.inquirerPromise) { L17479: const dynamicImport = new Function( L17480: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/main.cjsView on unpkg · L17478

container/build-runtime-image.shView file

•path = container/build-runtime-image.sh kind = build_helper sizeBytes = 2982 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

container/build-runtime-image.shView on unpkg