@zubriq/code@0.19.9-5: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@zubriq/code@0.19.9-5: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

13 flagged · loading source

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-22IFUCVR.jsView file

43init_esbuild_shims(); L44: import { execFile, spawn } from "node:child_process"; L45: import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L43

111case "win32": L112: command = "powershell.exe"; L113: args = [

High

Shell

Package source references shell execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L111

dist/chunks/chunk-3SV56PTH.jsView file

158L159: // import("./locales/**/*.js") in packages/cli/src/i18n/index.ts L160: var globImport_locales_js = __glob({

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-3SV56PTH.jsView on unpkg · L158

dist/chunks/chunk-MTNHGVV5.jsView file

124isValidEditorType, L125: resolveBaseUrl, L126: resolveMetadataKey, ... L7072: import path from "node:path"; L7073: import { spawn, spawnSync } from "node:child_process"; L7074: var CACHE_LIMIT = 40; ... L12561: const currentText = stateRef.current.lines.join("\n"); L12562: fs2.writeFileSync(filePath, currentText, { L12563: encoding: "utf8",

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-MTNHGVV5.jsView on unpkg · L124

1828Cross-file remote execution chain: dist/chunks/chunk-MTNHGVV5.js spawns dist/chunks/chunk-T2LU4KZB.js; helper contains network access plus dynamic code execution. L1828: var err = new Error( L1829: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1830: ); ... L1939: } L1940: if (process.platform === "win32") { L1941: const osRelease = os3.release().split("."); ... L1986: supportsColor: getSupportLevel, L1987: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1988: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4844: function wrapAnsi(string, columns, options) { L4845: return String(string).normalize().replaceAll("\r\n", "\n").split("\

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-MTNHGVV5.jsView on unpkg · L1828

1828var err = new Error( L1829: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1830: ); ... L1939: } L1940: if (process.platform === "win32") { L1941: const osRelease = os3.release().split("."); ... L1986: supportsColor: getSupportLevel, L1987: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1988: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4844: function wrapAnsi(string, columns, options) { L4845: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L4846: }

dist/chunks/chunk-QA3NQZ7X.jsView file

•context = ayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs10.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r2) => JSON.stringify(r2)).join("\n") + "\n";\n let fd;\n try {\n fd = fs10.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs10.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs10.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Get

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-QA3NQZ7X.jsView on unpkg

•path = dist/chunks/chunk-QA3NQZ7X.js kind = oversized_source_file sizeBytes = 5628803 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-QA3NQZ7X.jsView on unpkg

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

13 flagged

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView file

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

8patternName = aws_access_key severity = critical line = 8 matchedText = var tree...A");

Critical

Secret Pattern

AWS access key ID in dist/chunks/tree-sitter-bash-RPMGROCZ.js

dist/chunks/tree-sitter-bash-RPMGROCZ.jsView on unpkg · L8

dist/chunks/chunk-22IFUCVR.jsView file

Lines 23-63javascript

23 }

24 if (process.env["CI"] || process.env["DEBIAN_FRONTEND"] === "noninteractive") {

25 return false;

26 }

27 const isSSH = !!process.env["SSH_CONNECTION"];

28 if (process.platform === "linux") {

29 const displayVariables = ["DISPLAY", "WAYLAND_DISPLAY", "MIR_SOCKET"];

30 const hasDisplay = displayVariables.some((v) => !!process.env[v]);

31 if (!hasDisplay) {

32 return false;

33 }

34 }

35 if (isSSH && process.platform !== "linux") {

36 return false;

37 }

38 return true;

39}

40__name(shouldAttemptBrowserLaunch, "shouldAttemptBrowserLaunch");

41

42// packages/core/src/utils/secure-browser-launcher.ts

43init_esbuild_shims();

44import { execFile, spawn } from "node:child_process";

45import { promisify } from "node:util";

High

Child Process

Package source references child process execution.

dist/chunks/chunk-22IFUCVR.jsView on unpkg · L43

46import { platform } from "node:os";

47import { resolve } from "node:path";

48import { URL, fileURLToPath } from "node:url";

49var execFileAsync = promisify(execFile);

50function validateUrl(url, { allowFile = false, allowedFilePaths } = {}) {

51 let parsedUrl;

52 try {

53 parsedUrl = new URL(url);

54 } catch (_error) {

55 throw new Error(`Invalid URL: ${url}`);

56 }

57 const allowedProtocols = allowFile ? ["http:", "https:", "file:"] : ["http:", "https:"];

58 if (!allowedProtocols.includes(parsedUrl.protocol)) {

59 throw new Error(

60 `Unsafe protocol: ${parsedUrl.protocol}. Only ${allowedProtocols.join(

61 ", "

62 )} are allowed.`

63 );

Lines 91-131javascript

91 } catch (_error) {

92 console.warn(

93 `Failed to open BROWSER command ${browserCommand.command}: ${formatLaunchError(

94 _error

95 )}. Falling back to the platform browser opener.`

96 );

97 }

98 }

dist/chunks/chunk-3SV56PTH.jsView file

Lines 138-178javascript

138

139// packages/cli/src/i18n/index.ts

140init_esbuild_shims();

141import * as fs from "node:fs";

142import * as path from "node:path"

dist/chunks/chunk-MTNHGVV5.jsView file

124isValidEditorType, L125: resolveBaseUrl, L126: resolveMetadataKey, ... L7072: import path from "node:path"; L7073: import { spawn, spawnSync } from "node:child_process"; L7074: var CACHE_LIMIT = 40; ... L12561: const currentText = stateRef.current.lines.join("\n"); L12562: fs2.writeFileSync(filePath, currentText, { L12563: encoding: "utf8",

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/chunks/chunk-MTNHGVV5.jsView on unpkg · L124

1828Cross-file remote execution chain: dist/chunks/chunk-MTNHGVV5.js spawns dist/chunks/chunk-T2LU4KZB.js; helper contains network access plus dynamic code execution. L1828: var err = new Error( L1829: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1830: ); ... L1939: } L1940: if (process.platform === "win32") { L1941: const osRelease = os3.release().split("."); ... L1986: supportsColor: getSupportLevel, L1987: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1988: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4844: function wrapAnsi(string, columns, options) { L4845: return String(string).normalize().replaceAll("\r\n", "\n").split("\

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-MTNHGVV5.jsView on unpkg · L1828

1828var err = new Error( L1829: "Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types" L1830: ); ... L1939: } L1940: if (process.platform === "win32") { L1941: const osRelease = os3.release().split("."); ... L1986: supportsColor: getSupportLevel, L1987: stdout: translateLevel(supportsColor(true, tty.isatty(1))), L1988: stderr: translateLevel(supportsColor(true, tty.isatty(2))) ... L4844: function wrapAnsi(string, columns, options) { L4845: return String(string).normalize().replaceAll("\r\n", "\n").split("\n").map((line) => exec(expandTabs(line), columns, options)).join("\n"); L4846: }

dist/chunks/chunk-QA3NQZ7X.jsView file

•context = ayload: {\n snapshots: remappedSnapshots.map(serializeSnapshot)\n }\n };\n forked.push(snapshotRecord);\n }\n fs10.mkdirSync(chatsDir, { recursive: true });\n const body2 = forked.map((r2) => JSON.stringify(r2)).join("\n") + "\n";\n let fd;\n try {\n fd = fs10.openSync(targetPath, "wx", 384);\n } catch (err2) {\n if (err2.code === "EEXIST") {\n throw new Error(`Target session file already exists: ${newSessionId}`);\n }\n throw err2;\n }\n try {\n fs10.writeFileSync(fd, body2, { encoding: "utf8" });\n } finally {\n fs10.closeSync(fd);\n }\n await copyFileHistoryBackups(sourceSessionId, newSessionId);\n return { filePath: targetPath, copiedCount: forked.length };\n }\n /**\n * Get

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-QA3NQZ7X.jsView on unpkg

•path = dist/chunks/chunk-QA3NQZ7X.js kind = oversized_source_file sizeBytes = 5628803 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/chunks/chunk-QA3NQZ7X.jsView on unpkg

dist/vendor/ripgrep/x64-darwin/rgView file

•path = dist/vendor/ripgrep/x64-darwin/rg kind = native_binary sizeBytes = 4742676 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/ripgrep/x64-darwin/rgView on unpkg

dist/vendor/tree-sitter/tree-sitter.wasmView file

•path = dist/vendor/tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 190779 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/vendor/tree-sitter/tree-sitter.wasmView on unpkg

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web-shell/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg