@whop/cli@0.10.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@whop/cli@0.10.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @whop/cli@0.10.0 matchedIdentity = npm:QHdob3AvY2xp:0.10.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

3665// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.[redacted]node_modules/incur/dist/SyncMcp.js L3666: import { execFile } from "child_process"; L3667: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3665

40159} else if (process.platform === "win32") { L40160: execFile2("cmd.exe", ["/c", "start", "", url], ignore); L40161: } else {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L40159

452retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L452

452Cross-file remote execution chain: dist/index.js spawns dist/chunk-KFCNNWPI.js; helper contains network access plus dynamic code execution. L452: retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L452

1#!/usr/bin/env node L2: import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

452retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L452

dist/dist-2MZJLO2W.jsView file

6113if (this.opts.code.process) sourceCode = this.opts.code.process(sourceCode, sch); L6114: const validate2 = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L6115: this.scope.value(validateName, { ref: validate2 });

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/dist-2MZJLO2W.jsView on unpkg · L6113

Source & flagged code

8 flagged

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @whop/cli@0.10.0 matchedIdentity = npm:QHdob3AvY2xp:0.10.0 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

3665// ../../node_modules/.pnpm/incur@https+++codeload.github.com+whopio+incur+tar.[redacted]node_modules/incur/dist/SyncMcp.js L3666: import { execFile } from "child_process"; L3667: import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L3665

40159} else if (process.platform === "win32") { L40160: execFile2("cmd.exe", ["/c", "start", "", url], ignore); L40161: } else {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L40159

452retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L452

452Cross-file remote execution chain: dist/index.js spawns dist/chunk-KFCNNWPI.js; helper contains network access plus dynamic code execution. L452: retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L452

1#!/usr/bin/env node L2: import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url); L3: import {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

452retryable; L453: /** Process exit code. When set, `serve()` uses this instead of `1`. */ L454: exitCode; ... L499: const headers = new Headers(); L500: const query = new URLSearchParams(); L501: let method; ... L566: function buildRequest(input) { L567: const url = new URL(input.path, "http://localhost"); L568: input.query.forEach((value, key) => url.searchParams.set(key, value)); ... L584: const reader = response.body.getReader(); L585: const decoder = new TextDecoder(); L586: let buffer = "";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L452

dist/dist-2MZJLO2W.jsView file

Lines 6093-6133javascript

6093 } : { ref: sch.schema }),

6094 validateName,

6095 ValidationError: _ValidationError,

6096 schema: sch.schema,

6097 schemaEnv: sch,

6098 rootId,

6099 baseId: sch.baseId || rootId,