@zenalexa/unicli@0.227.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@zenalexa/unicli@0.227.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/adapters/youtube/innertube.jsView file

8patternName = google_api_key severity = high line = 8 matchedText = const IN...W8";

High

High Secret

Package contains a high-severity secret pattern.

dist/adapters/youtube/innertube.jsView on unpkg · L8

8patternName = google_api_key severity = high line = 8 matchedText = const IN...W8";

High

Secret Pattern

Google API key in dist/adapters/youtube/innertube.js

dist/adapters/youtube/innertube.jsView on unpkg · L8

dist/transport/sidecar.jsView file

1import { spawn } from "node:child_process"; L2: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/transport/sidecar.jsView on unpkg · L1

dist/transport/adapters/subprocess.jsView file

51} L52: return { command: "powershell.exe", args: planArgs }; L53: }

High

Shell

Package source references shell execution.

dist/transport/adapters/subprocess.jsView on unpkg · L51

dist/constants.jsView file

7import { createRequire } from "node:module"; L8: const require = createRequire(import.meta.url); L9: const pkg = require("../package.json");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/constants.jsView on unpkg · L7

dist/engine/template.jsView file

15out += L16: ch.charCodeAt(0) <= 31 || FILENAME_UNSAFE_CHARS.includes(ch) ? "_" : ch; L17: } ... L234: * Safe expression evaluator using Node.js VM sandbox. L235: * Provides stronger isolation than `new Function()` with a 250ms timeout L236: * to prevent DoS. Simple dotted access (the most common case) uses a ... L368: // Perplexity, MiniMax, QWeather, Novita, GCloud, etc.). Bind to L369: // process.env so the template engine resolves rather than coercing to L370: // empty string (which sent unauthenticated requests silently).

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/engine/template.jsView on unpkg · L15

dist/discovery/macos-dynamic.jsView file

1import { execFile, execFileSync } from "node:child_process"; L2: import { createHash } from "node:crypto"; ... L62: function currentShortcutsLocale() { L63: return normalizeLocale(process.env.LC_ALL || L64: process.env.LC_MESSAGES || L65: process.env.LANG || L66: Intl.DateTimeFormat().resolvedOptions().locale); L67: } ... L77: } L78: export function parseShortcutsListOutput(stdout) { L79: const shortcuts = []; ... L98: try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/discovery/macos-dynamic.jsView on unpkg · L1

dist/browser/launcher.jsView file

14*/ L15: import { execSync, spawn } from "node:child_process"; L16: import { existsSync } from "node:fs"; L17: import { createServer } from "node:net"; L18: import { getElectronApp } from "../electron-apps.js"; ... L27: export function isRemoteBrowser() { L28: return !!process.env.UNICLI_CDP_ENDPOINT; L29: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/browser/launcher.jsView on unpkg · L14

dist/adapters/xiaoyuzhou/media.jsView file

6async function readCredentials() { L7: if (process.env.XIAOYUZHOU_ACCESS_TOKEN) { L8: return { ... L14: const { readFile } = await import("node:fs/promises"); L15: const text = await readFile(join(homedir(), ".unicli", "xiaoyuzhou.json"), "utf8"); L16: return JSON.parse(text); L17: } ... L33: } L34: const response = await fetch(`https://api.xiaoyuzhoufm.com${path}`, { L35: method: "POST", L36: headers, L37: body: JSON.stringify(body),

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/adapters/xiaoyuzhou/media.jsView on unpkg · L6

dist/commands/mcp.jsView file

64const child = entry.kind === "ts" L65: ? spawn("npx", ["tsx", ...args], { L66: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/mcp.jsView on unpkg · L64

src/adapters/youtube/innertube.tsView file

10patternName = google_api_key severity = high line = 10 matchedText = const IN...W8";

High

Secret Pattern

Google API key in src/adapters/youtube/innertube.ts

src/adapters/youtube/innertube.tsView on unpkg · L10

Source & flagged code

11 flagged

dist/adapters/youtube/innertube.jsView file

Lines 1-28javascript

1/**

2 * YouTube InnerTube client — low-level API wrapper for YouTube's internal API.

3 *

4 * InnerTube is YouTube's internal RPC layer. Public endpoints don't require

5 * authentication for most read operations (search, player, browse, next).

6 */

7import { USER_AGENT } from "../../constants.js";

8const INNERTUBE_API_KEY = "AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8";

High

High Secret

Package contains a high-severity secret pattern.

dist/adapters/youtube/innertube.jsView on unpkg · L8

9const INNERTUBE_CLIENT = {

10 clientName: "WEB",

11 clientVersion: "2.20240101.00.00",

12 hl: "en",

13 gl: "US",

14};

15export async function innertubeFetch(endpoint, body) {

16 const url = `https://www.youtube.com/youtubei/v1/${endpoint}?key=${INNERTUBE_API_KEY}&prettyPrint=false`;

17 const resp = await fetch(url, {

18 method: "POST",

19 headers: {

20 "Content-Type": "application/json",

21 "User-Agent": USER_AGENT,

22 },

23 body: JSON.stringify({

24 context: { client: INNERTUBE_CLIENT },

25 ...body,

26 }),

27 });

28 if (!resp.ok)

8patternName = google_api_key severity = high line = 8 matchedText = const IN...W8";

High

Secret Pattern

Google API key in dist/adapters/youtube/innertube.js

dist/adapters/youtube/innertube.jsView on unpkg · L8

dist/transport/sidecar.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

dist/transport/sidecar.jsView on unpkg · L1

3export class StdioSidecarClient {

4

dist/transport/adapters/subprocess.jsView file

Lines 31-71javascript

31 args: [

32 "-a",

33 app,

34 ...(launchArgs.length > 0 ? ["--args", ...launchArgs] :

dist/constants.jsView file

Lines 1-22javascript

1/**

2 * Single source of truth for version and project constants.

3 *

4 * All version references in code MUST import from here.

5 * package.json is the canonical source — this file reads it at build time.

6 */

7import { createRequire } from "node:module";

8const require =

dist/engine/template.jsView file

Lines 1-35javascript

1/**

2 * Pipeline template engine — ${{ expression | filter | ... }} evaluation.

3 *

4 * Shared by every step handler so interpolation is uniform across the

5 * pipeline. The expression evaluator uses a null-prototype VM sandbox

6 * with a 50ms timeout and a deny-list for prototype-chain escape

7 * vectors; simple dotted access bypasses the VM for performance.

8 */

9import { runInNewContext } from "node:vm"

dist/discovery/macos-dynamic.jsView file

Lines 1-21javascript

1import { execFile, execFileSync } from "node:child_process";

2import { createHash } from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/discovery/macos-dynamic.jsView on unpkg · L1

3import { existsSync, readdirSync, statSync } from "node:fs";

dist/browser/launcher.jsView file

Lines 1-34javascript

1/**

2 * @owner src/browser/launcher.ts

3 * @does Discover Chrome executables, choose logged-in profile sources, seed automation user-data dirs, and launch Chrome with CDP.

4 * @needs node:child_process, node:fs, node:net, src/electron-apps, src/browser/local-profiles.ts, src/browser/profile-seed.ts

5 * @feeds src/browser/bridge.ts, src/commands/browser/index.ts, src/commands/status.ts, src/browser/doctor.ts, transport CDP browser adapter

6 * @breaks Missing Chrome/profile sources, seed failures, occupied ports, default-dir policy violations, and CDP startup timeouts throw explicit errors.

dist/adapters/xiaoyuzhou/media.jsView file

Lines 1-26javascript

1import { mkdir, writeFile } from "node:fs/promises";

2import { homedir } from "node:os";

3import { basename, join } from "node:path";

4import { cli, Strategy } from "../../registry.js"

dist/commands/mcp.jsView file

64const child = entry.kind === "ts" L65: ? spawn("npx", ["tsx", ...args], { L66: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/mcp.jsView on unpkg · L64

src/adapters/youtube/innertube.tsView file

10patternName = google_api_key severity = high line = 10 matchedText = const IN...W8";

High

Secret Pattern

Google API key in src/adapters/youtube/innertube.ts

src/adapters/youtube/innertube.tsView on unpkg · L10