@xylex-group/athena@5.5.4: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@xylex-group/athena@5.5.4: Malicious npm security report (Block) | LPM Firewall

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 16.6 MB of source, external domains: 127.0.0.1, access.line.me, accounts.google.com, accounts.spotify.com, api-m.paypal.com, api-m.sandbox.paypal.com, api.atlassian.com, api.dropboxapi.com, api.figma.com, api.github.com, api.kick.com, api.line.me, api.linear.app, api.linkedin.com, api.mollie.com, api.notion.com, api.paypal.com, api.polar.sh, api.resend.com, api.sandbox.paypal.com, api.spotify.com, api.stripe.com, api.vercel.com, api.weixin.qq.com, api.x.com, api.zoom.us, apis.roblox.com, appleid.apple.com, athena.invalid, athena.local, auth.athena-auth.com, auth.atlassian.com, auth.example.com, backboard.railway.com, cdn.discordapp.com, developers.facebook.com, discord.com, github.com, gitlab.com, graph.facebook.com, graph.microsoft.com, huggingface.co, id.kick.com, id.twitch.tv, id.vk.com, idp.paybin.io, kapi.kakao.com, kauth.kakao.com, limited.facebook.com, linear.app

Oversized source lightweight scan

dist/cli/index.cjs2.50 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsmirror2.athena-cluster.com

dist/cli/index.js2.50 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoShellHighEntropyStringsUrlStringsmirror2.athena-cluster.com

dist/index.cjs2.90 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/index.js2.89 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/next/server.cjs2.87 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/next/server.js2.86 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoShellDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/server.cjs2.49 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

dist/server.js2.49 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoDynamicRequireHighEntropyStringsUrlStringsapi.mollie.comapi.stripe.com

Source & flagged code

11 flagged · loading source

bin/athena-js-dev.mjsView file

5*/ L6: import { spawn } from "node:child_process"; L7: import path from "node:path";

High

Child Process

Package source references child process execution.

bin/athena-js-dev.mjsView on unpkg · L5

dist/next/server.jsView file

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L695: const social = normalizeSocialFromRaw(raw); L696: const envForIdentity = options.env ?? process.env; L697: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L819: function collapseSearchParams(params) { L820: const merged = new URLSearchParams(); L821: for (const [key, value] of params.entries()) { ... L1861: init_inspect();

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/next/server.jsView on unpkg · L1

17937async function loadNobleArgon2() { L17938: const importer = new Function("specifier", "return import(specifier)"); L17939: return importer("@noble/hashes/argon2.js");

High

Eval

Package source references dynamic code evaluation.

dist/next/server.jsView on unpkg · L17937

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L695: const social = normalizeSocialFromRaw(raw); L696: const envForIdentity = options.env ?? process.env; L697: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L819: function collapseSearchParams(params) { L820: const merged = new URLSearchParams(); L821: for (const [key, value] of params.entries()) { ... L1861: init_inspect();

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/next/server.jsView on unpkg · L1

1import { createHash, createDecipheriv, randomBytes, createCipheriv, createHmac, timingSafeEqual as timingSafeEqual$1, randomUUID } from 'crypto'; L2: import { AsyncLocalStorage } from 'async_hooks'; ... L11: import { fileURLToPath } from 'url'; L12: import { execSync } from 'child_process'; L13: ... L695: const social = normalizeSocialFromRaw(raw); L696: const envForIdentity = options.env ?? process.env; L697: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L819: function collapseSearchParams(params) { L820: const merged = new URLSearchParams(); L821: for (const [key, value] of params.entries()) { ... L1861: init_inspect();

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/next/server.jsView on unpkg · L1

bin/athena-js.jsView file

232}); L233: const cliModule = await import(cliEntrypointUrl); L234: if (typeof cliModule.runCLI !== "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/athena-js.jsView on unpkg · L232

dist/index.cjsView file

208Trigger-reachable chain: manifest.main -> dist/index.cjs L208: super({ L209: body: { missing: input.missing, operation: input.operation }, L210: code: ATHENA_BILLING_AUTHORIZATION_DENIED, ... L546: // src/auth/bridge/code.ts L547: function toBase64Url(bytes) { L548: let binary = ""; ... L1062: const social = normalizeSocialFromRaw(raw); L1063: const envForIdentity = options.env ?? process.env; L1064: const appIdentity = options.identity === void 0 ? resolveAthenaAppIdentity({ ... L1871: init_inspect(); L1872: DEFAULT_STRIPE_API_BASE_URL = "https://api.stripe.com"; L1873: }

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.cjsView on unpkg · L208

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.cjs: return "authorization"; return "authorization"; var ATHENA_BILLING_HTTP_ERROR; exports.AthenaBillingError = void 0; var ATHENA_BILLING_OPERATION_UNAVAILABLE, ATHENA_BILLING_AUTHORIZATION_DENIED, ATHENA_BILLING_LOCAL_RUNTIME_SERV... ATHENA_BILLING_AUTHORIZATION_DENIED = "ATHENA_BILLING_AUTHORIZATION_DENIED"; AthenaBillingAuthorizationError = class extends exports.AthenaBillingError { code: ATHENA_BILLING_AUTHORIZATION_DENIED, this.name = "AthenaBillingAuthorizationError"; authorizationAuditLog: "athena.authorization_audit_log",

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.cjsView on unpkg

dist/cli/index.cjsView file

9Cross-file remote execution chain: dist/cli/index.cjs spawns dist/index.cjs; helper contains network access plus dynamic code execution. L9: var pgsqlParser = require('pgsql-parser'); L10: var child_process = require('child_process'); L11: var os = require('os'); ... L1148: const isTty = options.isTty ?? Boolean( L1149: globalThis.process?.stdout?.isTTY L1150: ); ... L2378: function isAsciiAlphanumeric(ch) { L2379: const code = ch.charCodeAt(0); L2380: return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122; ... L2770: `${label} must be a non-empty absolute http(s) URL. Received ${describeReceivedValue(input)}.`, L2771: 'Set ATHENA_URL in the explicit env object (or pass createClient({ url, key })) to a full URL such as "https://mirror2.athena-cluster.com".

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index.cjsView on unpkg · L9

package.jsonView file

•dependencies registry_only=@xylex-group/athena

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

dist/next/server.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @xylex-group/athena@5.5.1 matchedIdentity = npm:QHh5bGV4LWdyb3VwL2F0aGVuYQ:5.5.1 similarity = 1.189 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/next/server.cjsView on unpkg