@xylex-group/athena@5.4.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@xylex-group/athena@5.4.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

dist/next/server.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/next/server.js: import { stat, rm, mkdir, rename, readFile, readdir, writeFile } from 'fs/promises'; DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; DEFAULT_MOLLIE_API_BASE_URL = "https://api.mollie.com"; var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com"; return trimmed.startsWith("http://") || trimmed.startsWith("https://"); if (trimmed === "http://" || trimmed === "https://" || trimmed.startsWith("undefined/") || trimmed.startsWith("null/")) { const message = 'Deprecated interpretation: auth.url is being treated as auth.upstreamUrl under same-origin routing. Use auth: { routing: "same-origin", upstreamUrl: "https://auth.... 'cr

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/next/server.jsView on unpkg

4import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L5: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L6: import * as z from 'zod'; ... L655: const social = normalizeSocialFromRaw(raw); L656: const envForIdentity = options.env ?? process.env; L657: const appIdentity = options.identity !== void 0 ? options.identity : resolveAthenaAppIdentity({ ... L908: super({ L909: body: { missing: input.missing, operation: input.operation }, L910: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L1499: init_inspect(); L1500: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1501: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L4

4import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L5: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L6: import * as z from 'zod'; ... L655: const social = normalizeSocialFromRaw(raw); L656: const envForIdentity = options.env ?? process.env; L657: const appIdentity = options.identity !== void 0 ? options.identity : resolveAthenaAppIdentity({ ... L908: super({ L909: body: { missing: input.missing, operation: input.operation }, L910: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L1499: init_inspect(); L1500: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1501: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L4

11194async function loadNobleArgon2() { L11195: const importer = new Function( L11196: "specifier",

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/next/server.jsView on unpkg · L11194

bin/athena-js.jsView file

107const cliEntrypointUrl = pathToFileURL(cliEntrypointPath).href; L108: const cliModule = await import(cliEntrypointUrl); L109: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L107

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { mkdir, writeFile, readFile, readdir, stat, rm, rename } from 'fs/promises'; return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR, AthenaBillingError, ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERVER_REQUIRED, ATHENA_B... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/cli/index.jsView file

7Cross-file remote execution chain: dist/cli/index.js spawns dist/next/server.js; helper contains network access plus dynamic code execution. L7: import { parse as parse$1 } from 'pgsql-parser'; L8: import { spawnSync } from 'child_process'; L9: ... L84: L85: // package.json L86: var package_default; ... L362: type: "git", L363: url: "git+https://github.com/xylex-group/athena.git", L364: directory: "packages/athena-js" ... L1522: const isTty = options.isTty ?? Boolean( L1523: globalThis.process?.stdout?.isTTY L1524: );

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L7

dist/cli/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xylex-group/athena@5.3.0 matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.3.0 similarity = 0.490 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.cjsView on unpkg

Source & flagged code

9 flagged

bin/athena-js-dev.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Workspace-dev CLI: runs TypeScript `src/cli/bin.ts` via tsx.

4 * Production `bin/athena-js.js` continues to load packed `dist/cli/index.js`.

5 */

6import { spawn } from "node:child_process";

7import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

8import { fileURLToPath } from "node:url";

9

10const binPath = fileURLToPath(import.meta.url);

11const packageRoot = path.resolve(path.dirname(binPath), "..");

12const entry = path.join(packageRoot, "src", "cli", "bin.ts");

13const projectCwd = process.cwd();

14

15const child = spawn(

16 process.execPath,

17 ["--import", "tsx", entry, "--cwd", projectCwd, ...process.argv.slice(2)],

18 {

19 cwd: packageRoot,

20 env: process.env,

21 stdio: "inherit",

22 },

23);

24

25child.on("exit", (code, signal) => {

dist/next/server.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/next/server.js: import { stat, rm, mkdir, rename, readFile, readdir, writeFile } from 'fs/promises'; DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; DEFAULT_MOLLIE_API_BASE_URL = "https://api.mollie.com"; var DEFAULT_ATHENA_AUTH_ORIGIN = "https://auth.athena-auth.com"; return trimmed.startsWith("http://") || trimmed.startsWith("https://"); if (trimmed === "http://" || trimmed === "https://" || trimmed.startsWith("undefined/") || trimmed.startsWith("null/")) { const message = 'Deprecated interpretation: auth.url is being treated as auth.upstreamUrl under same-origin routing. Use auth: { routing: "same-origin", upstreamUrl: "https://auth.... 'cr

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/next/server.jsView on unpkg

4import { generateRegistrationOptions, generateAuthenticationOptions, verifyRegistrationResponse, verifyAuthenticationResponse } from '@simplewebauthn/server'; L5: import { isoBase64URL, decodeClientDataJSON, decodeAttestationObject, parseAuthenticatorData } from '@simplewebauthn/server/helpers'; L6: import * as z from 'zod'; ... L655: const social = normalizeSocialFromRaw(raw); L656: const envForIdentity = options.env ?? process.env; L657: const appIdentity = options.identity !== void 0 ? options.identity : resolveAthenaAppIdentity({ ... L908: super({ L909: body: { missing: input.missing, operation: input.operation }, L910: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L1499: init_inspect(); L1500: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1501: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L4

bin/athena-js.jsView file

Lines 87-127javascript

87}

88

89async function main() {

90 const argv = process.argv.slice(2);

91

92 // Fast path: version works even when dist/cli is missing (still report package.json).

dist/index.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: import { mkdir, writeFile, readFile, readdir, stat, rm, rename } from 'fs/promises'; return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR, AthenaBillingError, ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERVER_REQUIRED, ATHENA_B... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

dist/cli/index.jsView file

7Cross-file remote execution chain: dist/cli/index.js spawns dist/next/server.js; helper contains network access plus dynamic code execution. L7: import { parse as parse$1 } from 'pgsql-parser'; L8: import { spawnSync } from 'child_process'; L9: ... L84: L85: // package.json L86: var package_default; ... L362: type: "git", L363: url: "git+https://github.com/xylex-group/athena.git", L364: directory: "packages/athena-js" ... L1522: const isTty = options.isTty ?? Boolean( L1523: globalThis.process?.stdout?.isTTY L1524: );

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.jsView on unpkg · L7

dist/cli/index.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xylex-group/athena@5.3.0 matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.3.0 similarity = 0.490 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.cjsView on unpkg