@xylex-group/athena@4.3.1: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@xylex-group/athena@4.3.1: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { mkdir, writeFile, readFile, stat } from 'fs/promises'; function isDynamicBaseURLConfig(baseURL) { return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts); const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0; const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0; const secure = options.advanced?.useSecureCookies === void 0 ? dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("h... co

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { mkdir, writeFile, readFile, stat } from 'fs/promises'; const secure = options.advanced?.useSecureCookies === void 0 ? dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("h... var ATHENA_DEFAULT_BASE_URL = "https://mirror2.athena-cluster.com"; 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".' 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".' 'Use a full URL including the protocol, for example

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

6733function importConfigModule(moduleSpecifier) { L6734: const runtimeImport = new Function( L6735: "moduleSpecifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L6733

bin/athena-js.jsView file

107const cliEntrypointUrl = pathToFileURL(cliEntrypointPath).href; L108: const cliModule = await import(cliEntrypointUrl); L109: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L107

dist/cli/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xylex-group/athena@4.2.0 matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:4.2.0 similarity = 0.703 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.cjsView on unpkg

Source & flagged code

5 flagged

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { mkdir, writeFile, readFile, stat } from 'fs/promises'; function isDynamicBaseURLConfig(baseURL) { return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts); const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0; const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0; const secure = options.advanced?.useSecureCookies === void 0 ? dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("h... co

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: import { mkdir, writeFile, readFile, stat } from 'fs/promises'; const secure = options.advanced?.useSecureCookies === void 0 ? dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("h... var ATHENA_DEFAULT_BASE_URL = "https://mirror2.athena-cluster.com"; 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".' 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".' 'Use a full URL including the protocol, for example

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

6733function importConfigModule(moduleSpecifier) { L6734: const runtimeImport = new Function( L6735: "moduleSpecifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L6733

bin/athena-js.jsView file

Lines 87-127javascript

87}

88

89async function main() {

90 const argv = process.argv.slice(2);

91

92 // Fast path: version works even when dist/cli is missing (still report package.json).

dist/cli/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xylex-group/athena@4.2.0 matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:4.2.0 similarity = 0.703 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.cjsView on unpkg