@whop/cli@0.0.6: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@whop/cli@0.0.6: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

6 flagged · loading source

dist/chunk-Z7WDX64Z.jsView file

20004// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+5ca60d5/node_modules/incur/dist/SyncMcp.js L20005: import { execFile } from "child_process"; L20006: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-Z7WDX64Z.jsView on unpkg · L20004

23485} else if (process.platform === "win32") { L23486: execFile2("cmd.exe", ["/c", "start", "", url], ignore); L23487: } else {

High

Shell

Package source references shell execution.

dist/chunk-Z7WDX64Z.jsView on unpkg · L23485

19Cross-file remote execution chain: dist/chunk-Z7WDX64Z.js spawns dist/chunk-CXNQ6UGC.js; helper contains network access plus dynamic code execution. L19: { L20: url: "https://{defaultHost}", L21: variables: { ... L116: properties: { L117: data: { L118: type: "array", ... L8034: ], L8035: description: "Private notes visible only to the account owner. Not shown to customers." L8036: }, ... L16794: var DEFAULT_BASE_URL = "https://api.whop.com/api/v1"; L16795: function apiBaseUrl(env = process.env) { L16796: return env.WHOP_API_BASE_URL?.trim() || DEFAULT_BASE_URL;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-Z7WDX64Z.jsView on unpkg · L19

1#!/usr/bin/env node L2: import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-Z7WDX64Z.jsView on unpkg · L1

19{ L20: url: "https://{defaultHost}", L21: variables: { ... L116: properties: { L117: data: { L118: type: "array", ... L8034: ], L8035: description: "Private notes visible only to the account owner. Not shown to customers." L8036: }, ... L16794: var DEFAULT_BASE_URL = "https://api.whop.com/api/v1"; L16795: function apiBaseUrl(env = process.env) { L16796: return env.WHOP_API_BASE_URL?.trim() || DEFAULT_BASE_URL;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-Z7WDX64Z.jsView on unpkg · L19

dist/dist-FTK7GWLH.jsView file

6114if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L6115: const validate2 = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L6116: this.scope.value(validateName, { ref: validate2 });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-FTK7GWLH.jsView on unpkg · L6114

Source & flagged code

6 flagged

dist/chunk-Z7WDX64Z.jsView file

20004// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.gz+5ca60d5/node_modules/incur/dist/SyncMcp.js L20005: import { execFile } from "child_process"; L20006: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-Z7WDX64Z.jsView on unpkg · L20004

23485} else if (process.platform === "win32") { L23486: execFile2("cmd.exe", ["/c", "start", "", url], ignore); L23487: } else {

High

Shell

Package source references shell execution.

dist/chunk-Z7WDX64Z.jsView on unpkg · L23485

19Cross-file remote execution chain: dist/chunk-Z7WDX64Z.js spawns dist/chunk-CXNQ6UGC.js; helper contains network access plus dynamic code execution. L19: { L20: url: "https://{defaultHost}", L21: variables: { ... L116: properties: { L117: data: { L118: type: "array", ... L8034: ], L8035: description: "Private notes visible only to the account owner. Not shown to customers." L8036: }, ... L16794: var DEFAULT_BASE_URL = "https://api.whop.com/api/v1"; L16795: function apiBaseUrl(env = process.env) { L16796: return env.WHOP_API_BASE_URL?.trim() || DEFAULT_BASE_URL;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-Z7WDX64Z.jsView on unpkg · L19

1#!/usr/bin/env node L2: import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-Z7WDX64Z.jsView on unpkg · L1

19{ L20: url: "https://{defaultHost}", L21: variables: { ... L116: properties: { L117: data: { L118: type: "array", ... L8034: ], L8035: description: "Private notes visible only to the account owner. Not shown to customers." L8036: }, ... L16794: var DEFAULT_BASE_URL = "https://api.whop.com/api/v1"; L16795: function apiBaseUrl(env = process.env) { L16796: return env.WHOP_API_BASE_URL?.trim() || DEFAULT_BASE_URL;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-Z7WDX64Z.jsView on unpkg · L19

dist/dist-FTK7GWLH.jsView file

Lines 6094-6134javascript

6094 } : { ref: sch.schema }),

6095 validateName,

6096 ValidationError: _ValidationError,

6097 schema: sch.schema,

6098 schemaEnv: sch,

6099 rootId,

6100 baseId: sch.baseId || rootId,