@xylex-group/athena@5.5.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@xylex-group/athena@5.5.1: Suspicious npm security report (Warn) | LPM Firewall

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 16.6 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.atlassian.com, api.dropboxapi.com, api.figma.com, api.github.com, api.kick.com, api.line.me, api.linear.app, api.linkedin.com, api.mollie.com, api.notion.com, api.paypal.com, api.polar.sh, api.resend.com, api.sandbox.paypal.com, api.spotify.com, api.stripe.com, api.vercel.com, api.weixin.qq.com, api.x.com, api.zoom.us, apis.roblox.com, appleid.apple.com, athena.invalid, athena.local, auth.athena-auth.com, auth.atlassian.com, auth.example.com, backboard.railway.com, cdn.discordapp.com, developers.facebook.com, discord.com, github.com, gitlab.com, graph.facebook.com, graph.microsoft.com, huggingface.co, id.kick.com, id.twitch.tv, id.vk.com, idp.paybin.io, kapi.kakao.com, kauth.kakao.com, limited.facebook.com, linear.app

Oversized source lightweight scan

dist/cli/index.cjs2.51 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsmirror2.athena-cluster.com

dist/cli/index.js2.50 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsmirror2.athena-cluster.com

dist/index.cjs2.89 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/index.js2.88 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/next/server.cjs2.86 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/next/server.js2.86 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoShellDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/server.cjs2.48 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/server.js2.48 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

Source & flagged code

9 flagged · loading source

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

dist/next/server.jsView file

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L686: const social = normalizeSocialFromRaw(raw); L687: const envForIdentity = options.env ?? process.env; L688: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L810: function collapseSearchParams(params) { L811: const merged = new URLSearchParams(); L812: for (const [key, value] of params.entries()) { ... L1852: init_inspect();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/next/server.jsView on unpkg · L1

17928async function loadNobleArgon2() { L17929: const importer = new Function("specifier", "return import(specifier)"); L17930: return importer("@noble/hashes/argon2.js");

High

Eval

Package source references dynamic code evaluation.

dist/next/server.jsView on unpkg · L17928

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L686: const social = normalizeSocialFromRaw(raw); L687: const envForIdentity = options.env ?? process.env; L688: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L810: function collapseSearchParams(params) { L811: const merged = new URLSearchParams(); L812: for (const [key, value] of params.entries()) { ... L1852: init_inspect();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L1

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L686: const social = normalizeSocialFromRaw(raw); L687: const envForIdentity = options.env ?? process.env; L688: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L810: function collapseSearchParams(params) { L811: const merged = new URLSearchParams(); L812: for (const [key, value] of params.entries()) { ... L1852: init_inspect();

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L1

bin/athena-js.jsView file

232}); L233: const cliModule = await import(cliEntrypointUrl); L234: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L232

dist/index.cjsView file

208Trigger-reachable chain: manifest.main -> dist/index.cjs L208: super({ L209: body: { missing: input.missing, operation: input.operation }, L210: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L546: // src/auth/bridge/code.ts L547: function toBase64Url(bytes) { L548: let binary = ""; ... L1053: const social = normalizeSocialFromRaw(raw); L1054: const envForIdentity = options.env ?? process.env; L1055: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L1862: init_inspect(); L1863: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1864: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L208

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR; exports.AthenaBillingError = void 0; var ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERV... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends exports.AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError"; authorizationAuditLog: "athena.authorization_audit_log",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

dist/cli/index.cjsView file

9Cross-file remote execution chain: dist/cli/index.cjs spawns dist/index.cjs; helper contains network access plus dynamic code execution. L9: var pgsqlParser = require('pgsql-parser'); L10: var child_process = require('child_process'); L11: var os = require('os'); ... L1148: const isTty = options.isTty ?? Boolean( L1149: globalThis.process?.stdout?.isTTY L1150: ); ... L2378: function isAsciiAlphanumeric(ch) { L2379: const code = ch.charCodeAt(0); L2380: return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122; ... L2770: `${label} must be a non-empty absolute http(s) URL. Received ${describeReceivedValue(input)}.`, L2771: 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L9

Source & flagged code

9 flagged

bin/athena-js-dev.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Workspace-dev CLI: runs TypeScript `src/cli/bin.ts` via tsx.

4 * Production `bin/athena-js.js` continues to load packed `dist/cli/index.js`.

5 */

6import { spawn } from "node:child_process";

7import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

8import { fileURLToPath } from "node:url";

9

10const binPath = fileURLToPath(import.meta.url);

11const packageRoot = path.resolve(path.dirname(binPath), "..");

12const entry = path.join(packageRoot, "src", "cli", "bin.ts");

13const projectCwd = process.cwd();

14

15const child = spawn(

16 process.execPath,

17 ["--import", "tsx", entry, "--cwd", projectCwd, ...process.argv.slice(2)],

18 {

19 cwd: packageRoot,

20 env: process.env,

21 stdio: "inherit",

22 }

23);

24

25child.on("exit", (code, signal) => {

dist/next/server.jsView file

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L686: const social = normalizeSocialFromRaw(raw); L687: const envForIdentity = options.env ?? process.env; L688: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L810: function collapseSearchParams(params) { L811: const merged = new URLSearchParams(); L812: for (const [key, value] of params.entries()) { ... L1852: init_inspect();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/next/server.jsView on unpkg · L1

17928async function loadNobleArgon2() { L17929: const importer = new Function("specifier", "return import(specifier)"); L17930: return importer("@noble/hashes/argon2.js");

High

Eval

Package source references dynamic code evaluation.

dist/next/server.jsView on unpkg · L17928

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L686: const social = normalizeSocialFromRaw(raw); L687: const envForIdentity = options.env ?? process.env; L688: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L810: function collapseSearchParams(params) { L811: const merged = new URLSearchParams(); L812: for (const [key, value] of params.entries()) { ... L1852: init_inspect();

bin/athena-js.jsView file

Lines 212-252javascript

212 if (isVersionArgv(argv)) {

213 const short = argv.includes("--short") || argv.includes("-q");

214 const version

dist/index.cjsView file

208Trigger-reachable chain: manifest.main -> dist/index.cjs L208: super({ L209: body: { missing: input.missing, operation: input.operation }, L210: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L546: // src/auth/bridge/code.ts L547: function toBase64Url(bytes) { L548: let binary = ""; ... L1053: const social = normalizeSocialFromRaw(raw); L1054: const envForIdentity = options.env ?? process.env; L1055: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L1862: init_inspect(); L1863: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1864: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L208

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR; exports.AthenaBillingError = void 0; var ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERV... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends exports.AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError"; authorizationAuditLog: "athena.authorization_audit_log",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

dist/cli/index.cjsView file

9Cross-file remote execution chain: dist/cli/index.cjs spawns dist/index.cjs; helper contains network access plus dynamic code execution. L9: var pgsqlParser = require('pgsql-parser'); L10: var child_process = require('child_process'); L11: var os = require('os'); ... L1148: const isTty = options.isTty ?? Boolean( L1149: globalThis.process?.stdout?.isTTY L1150: ); ... L2378: function isAsciiAlphanumeric(ch) { L2379: const code = ch.charCodeAt(0); L2380: return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122; ... L2770: `${label} must be a non-empty absolute http(s) URL. Received ${describeReceivedValue(input)}.`, L2771: 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L9