@xylex-group/athena@5.3.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@xylex-group/athena@5.3.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/next/client.jsView file

19450error: "invalid_query", L19451: message: "multi-statement query requires D1 batch() or exec() support", L19452: ok: false

High

Child Process

Package source references child process execution.

dist/next/client.jsView on unpkg · L19450

dist/next/server.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/next/server.js: import { stat, rm, readFile, readdir, mkdir, writeFile } from 'fs/promises'; var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com"; return trimmed.startsWith("http://") || trimmed.startsWith("https://"); if (trimmed === "http://" || trimmed === "https://" || trimmed.startsWith("undefined/") || trimmed.startsWith("null/")) { const message = 'Deprecated interpretation: auth.url is being treated as auth.upstreamUrl under same-origin routing. Use auth: { routing: "same-origin", upstreamUrl: "https://auth.... 'createAthenaAuthProxyHandlers({ client }) needs a proxy upstream on the client. Configure auth: { routing: "same-origin",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/next/server.jsView on unpkg

3import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L4: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L5: import { generateKeyPair, exportJWK, SignJWT } from 'jose'; ... L1569: } L1570: function collectEnvAppOrigins(env = process.env) { L1571: const origins = []; ... L1832: L1833: // package.json L1834: var package_default = { ... L2047: var ATHENA_AUTH_PATH = "/api/auth"; L2048: var LOCAL_DEV_ORIGIN = "http://localhost:3000"; L2049: var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L3

4818async function loadNobleArgon2() { L4819: const importer = new Function( L4820: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/next/server.jsView on unpkg · L4818

bin/athena-js.jsView file

107const cliEntrypointUrl = pathToFileURL(cliEntrypointPath).href; L108: const cliModule = await import(cliEntrypointUrl); L109: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L107

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { mkdir, writeFile, readFile, readdir, stat, rm } from 'fs/promises'; function isDynamicBaseURLConfig(baseURL) { return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts); const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0; const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0; const secure = options.advanced?.useSecureCookies === void 0 ? dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.starts

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/cli/index.jsView file

7Cross-file remote execution chain: dist/cli/index.js spawns dist/next/server.js; helper contains network access plus dynamic code execution. L7: import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L8: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L9: import { generateKeyPair, exportJWK, SignJWT } from 'jose'; L10: import { parse as parse$1 } from 'pgsql-parser'; L11: import { spawnSync } from 'child_process'; L12: ... L87: L88: // package.json L89: var package_default; ... L336: type: "git", L337: url: "git+https://github.com/xylex-group/athena.git", L338: directory: "packages/athena-js"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L7

Source & flagged code

7 flagged

dist/next/client.jsView file

19450error: "invalid_query", L19451: message: "multi-statement query requires D1 batch() or exec() support", L19452: ok: false

High

Child Process

Package source references child process execution.

dist/next/client.jsView on unpkg · L19450

dist/next/server.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/next/server.js: import { stat, rm, readFile, readdir, mkdir, writeFile } from 'fs/promises'; var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com"; return trimmed.startsWith("http://") || trimmed.startsWith("https://"); if (trimmed === "http://" || trimmed === "https://" || trimmed.startsWith("undefined/") || trimmed.startsWith("null/")) { const message = 'Deprecated interpretation: auth.url is being treated as auth.upstreamUrl under same-origin routing. Use auth: { routing: "same-origin", upstreamUrl: "https://auth.... 'createAthenaAuthProxyHandlers({ client }) needs a proxy upstream on the client. Configure auth: { routing: "same-origin",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/next/server.jsView on unpkg

3import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L4: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L5: import { generateKeyPair, exportJWK, SignJWT } from 'jose'; ... L1569: } L1570: function collectEnvAppOrigins(env = process.env) { L1571: const origins = []; ... L1832: L1833: // package.json L1834: var package_default = { ... L2047: var ATHENA_AUTH_PATH = "/api/auth"; L2048: var LOCAL_DEV_ORIGIN = "http://localhost:3000"; L2049: var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com";

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L3

4818async function loadNobleArgon2() { L4819: const importer = new Function( L4820: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/next/server.jsView on unpkg · L4818

bin/athena-js.jsView file

Lines 87-127javascript

87}

88

89async function main() {

90 const argv = process.argv.slice(2);

91

92 // Fast path: version works even when dist/cli is missing (still report package.json).

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { mkdir, writeFile, readFile, readdir, stat, rm } from 'fs/promises'; function isDynamicBaseURLConfig(baseURL) { return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts); const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0; const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0; const secure = options.advanced?.useSecureCookies === void 0 ? dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.starts

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/cli/index.jsView file

7Cross-file remote execution chain: dist/cli/index.js spawns dist/next/server.js; helper contains network access plus dynamic code execution. L7: import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L8: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L9: import { generateKeyPair, exportJWK, SignJWT } from 'jose'; L10: import { parse as parse$1 } from 'pgsql-parser'; L11: import { spawnSync } from 'child_process'; L12: ... L87: L88: // package.json L89: var package_default; ... L336: type: "git", L337: url: "git+https://github.com/xylex-group/athena.git", L338: directory: "packages/athena-js"

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L7