@wwkit/sshproxy@1.0.9: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@wwkit/sshproxy@1.0.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/sshkey.jsView file

2import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sshkey.jsView on unpkg · L2

2Trigger-reachable chain: manifest.main -> src/index.js -> src/SshCommands.js -> src/sshkey.js L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/sshkey.jsView on unpkg · L2

2Trigger-reachable persistence chain: manifest.main -> src/index.js -> src/SshCommands.js -> src/sshkey.js L2: import path from 'node:path' L3: import { spawnSync } from 'node:child_process' L4: ... L34: `mkdir -p ~/.ssh && chmod 700 ~/.ssh && ` L35: + `echo '${pubKey}' > ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys` L36: )

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/sshkey.jsView on unpkg · L2

src/OSystem.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/OSystem.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9116449b1da25d48 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/OSystem.jsView on unpkg

src/ProxyManager.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/ProxyManager.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ProxyManager.jsView on unpkg

bin/index.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = bin/index.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 26-51json

26 "proxy",

27 "ssh",

28 "autossh",

29 "chrome"

30 ],

31 "license": "MIT",

32 "publishConfig": {

33 "registry": "https://registry.npmjs.org/",

34 "access": "public"

35 },

36 "dependencies": {

37 "dotenv": "^16.4.5",

38 "json5": "^2.2.3",

39 "ssh2": "^1.16.0",

40 "@wwkit/shared": "1.0.7"

41 },

42 "devDependencies": {

43 "jest": "^29.7.0"

44 },

45 "scripts": {

46 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js --no-cache tests/unit",

48 "test:all": "node --experimental-vm-modules node_modules/jest/bin/jest.js --no-cache tests/unit",

49 "release": "node ../../packages/shared/bin/release-pkg.js"

50 }

51}

src/sshkey.jsView file

Lines 1-22javascript

1import fs from 'node:fs'

2import path from 'node:path'

3import { spawnSync } from 'node:child_process'

4

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

src/sshkey.jsView on unpkg · L2

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/OSystem.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/OSystem.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 9116449b1da25d48 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/OSystem.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 shingleOverlap = 10 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

src/OSystem.jsView on unpkg

src/ProxyManager.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = src/ProxyManager.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/ProxyManager.jsView on unpkg

bin/index.jsView file

•matchType = normalized_sha256 matchedPackage = @wwkit/sshproxy@1.0.10 matchedPath = bin/index.js matchedIdentity = npm:QHd3a2l0L3NzaHByb3h5:1.0.10 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/index.jsView on unpkg