@z2h-academy/tutor: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@z2h-academy/tutor: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/cli/login.jsView file

19import { fileURLToPath } from "node:url"; L20: const __dirname = dirname(fileURLToPath(import.meta.url)); L21: const GITHUB_DEVICE_URL = "https://github.com/login/device/code"; L22: const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token"; L23: const PROVISION_URL = process.env.TUTOR_PROVISION_URL ?? L24: "https://ftpxfyctzcchkldeccnq.supabase.co/functions/v1/tutor-provision"; ... L33: headers: { "Content-Type": "application/json", Accept: "application/json" }, L34: body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }), L35: }); ... L38: } L39: const device = (await deviceResp.json()); L40: console.log("");

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/cli/login.jsView on unpkg · L19

dist/cli/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @z2h-academy/tutor@0.5.11 matchedPath = dist/cli/runtime.js matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/runtime.jsView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @z2h-academy/tutor@0.5.14 matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.14 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

•matchType = token_shingles matchedPackage = @z2h-academy/tutor@0.5.11 matchedPath = dist/cli/index.js matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.11 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/runtime/opencode.jsView file

•matchType = normalized_sha256 matchedPackage = @z2h-academy/tutor@0.5.11 matchedPath = dist/runtime/opencode.js matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/opencode.jsView on unpkg

Source & flagged code

5 flagged

dist/cli/login.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * tutor login — CLI de autenticación para estudiantes.

4 *

5 * Implementa el device flow de GitHub:

6 * 1. Pide un device code a GitHub (client_id de la OAuth app de z2h-academy).

7 * 2. Muestra el código + URL de verificación al estudiante.

8 * 3. Polea hasta que el estudiante autorice (mismo UX que `gh auth login`).

9 * 4. Con el access token, llama a la Edge Function `tutor-provision`

10 * (Supabase) que valida la whitelist pre_enrollment y crea una service

11 * account de MinIO read-only.

12 * 5. Guarda las credenciales en ~/.config/z2h/tutor.env (chmod 600).

13 *

14 * Uso: node dist/cli/login.js

15 */

16import { mkdir, writeFile, chmod } from "node:fs/promises";

17import { homedir } from "node:os";

18import { dirname, join } from "node:path";

19import { fileURLToPath } from "node:url";

20const __dirname = dirname(fileURLToPath(import.meta.url));

21const GITHUB_DEVICE_URL = "https://github.com/login/device/code";

22const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";

23const PROVISION_URL = process.env.TUTOR_PROVISION_URL ??

24 "https://ftpxfyctzcchkldeccnq.supabase.co/functions/v1/tutor-provision";

25const CLIENT_ID = process.env.TUTOR_GITHUB_CLIENT_ID ?? "Ov23liYqkrsoQJo0ZMMc";

26const SCOPE = "user:email";

27const ENV_DIR = join(homedir(), ".config", "z2h");

28const ENV_FILE = join(ENV_DIR, "tutor.env");

29async function main() {

30 console.log("[tutor] iniciando login con GitHub (device flow)...");

31 const deviceResp = await fetch(GITHUB_DEVICE_URL, {

32 method: "POST",

33 headers: { "Content-Type": "application/json", Accept: "application/json" },

34 body: JSON.stringify({ client_id: CLIENT_ID, scope: SCOPE }),

35 });

36 if (!deviceResp.ok) {

37 fail(`no se pudo obtener device code: ${deviceResp.status}`);

38 }

39 const device = (await deviceResp.json());

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/cli/login.jsView on unpkg · L19

dist/cli/runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @z2h-academy/tutor@0.5.11 matchedPath = dist/cli/runtime.js matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/runtime.jsView on unpkg

dist/cli/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @z2h-academy/tutor@0.5.14 matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.14 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/index.jsView on unpkg

•matchType = token_shingles matchedPackage = @z2h-academy/tutor@0.5.11 matchedPath = dist/cli/index.js matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.11 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/index.jsView on unpkg

dist/runtime/opencode.jsView file

•matchType = normalized_sha256 matchedPackage = @z2h-academy/tutor@0.5.11 matchedPath = dist/runtime/opencode.js matchedIdentity = npm:QHoyaC1hY2FkZW15L3R1dG9y:0.5.11 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/runtime/opencode.jsView on unpkg