@zubriq/code@0.24.4-1: Suspicious npm security report (Warn)

Loading npm security reports…

@zubriq/code@0.24.4-1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged

dist/sandboxBwrapRelay.jsView file

Lines 1-21javascript

1// packages/core/src/sandbox/bwrap-relay.ts

2import { spawn } from "node:child_process";

3import {

High

Child Process

Package source references child process execution.

dist/sandboxBwrapRelay.jsView on unpkg · L1

4 closeSync,

5 constants,

6 createReadStream,

7 fstatSync,

8 openSync,

9 readFileSync,

10 readlinkSync,

11 unlinkSync,

12 writeFileSync

13} from "node:fs";

15// packages/core/src/sandbox/bwrap-status.ts

16var MAX_STATUS_BYTES = 16 * 1024;

17function parseBwrapStatus(wire2, exitCode) {

18 if (Buffer.byteLength(wire2) > MAX_STATUS_BYTES || !wire2.endsWith("\n")) {

19 return { state: "unconfirmed" };

20 }

21 const payloadExitObserved = wire2.trim().split("\n").some((line) => {

dist/chunks/chunk-XRDD2MQZ.jsView file

13014var debugLogger15 = createDebugLogger("TERMINAL_SETUP"); L13015: var execAsync = promisify(exec); L13016: function stripJsonComments2(content) {

High

Shell

Package source references shell execution.

dist/chunks/chunk-XRDD2MQZ.jsView on unpkg · L13014

dist/opentui-assets/@opentui/core/parser.worker.jsView file

Lines 1-21javascript

1import { createRequire } from "node:module";

2var __require = /* @__PURE__ */ createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/opentui-assets/@opentui/core/parser.worker.jsView on unpkg · L1

dist/bundled/browser-use/runtime/index.jsView file

Lines 63-103javascript

63 return value;

64}

65function timeoutOptions(options) {

66 const value = optionRecord(options, "options");

dist/chunks/chunk-5NFAKADR.jsView file

35module.exports = depd; L36: var basePath = process.cwd(); L37: function containsNamespace(str, namespace) { ... L114: } L115: var str = process.env.NO_DEPRECATION || ""; L116: return containsNamespace(str, namespace); ... L174: } L175: var format = process.stderr.isTTY ? formatColor : formatPlain; L176: var output = format.call(this, msg, caller, stack.slice(i)); L177: process.stderr.write(output + "\n", "utf8"); L178: } ... L267: site.name = fn.name;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-5NFAKADR.jsView on unpkg · L35

dist/chunks/server-XH67IDAZ.jsView file

18import { L19: deriveWebSocketBase, L20: openQwenAsrRealtimeStream, ... L111: resolveCdpMcpCommand, L112: sanitizeForStderr, L113: selectLanAddress, ... L1238: closetag: "closeTagHandler", L1239: cdata: "cdataHandler", L1240: error: "errorHandler", ... L1491: let limit = chunk.length; L1492: const lastCode = chunk.charCodeAt(limit - 1); L1493: if (!end && // A trailing CR or surrogate must be carried over to the next

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/chunks/server-XH67IDAZ.jsView on unpkg · L18

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/server-XH67IDAZ.jsView on unpkg · L18

dist/chunks/chunk-N4C6MQ4C.jsView file

•context = Logger14.warn(\n `invalid cursor signing key at ${keyPath}; replacing persisted key`\n );\n return void 0;\n } catch (error3) {\n if (error3.code === "ENOENT") {\n return void 0;\n }\n throw error3;\n }\n}\n__name(readCursorHmacKey, "readCursorHmacKey");\nfunction writeCursorHmacKey(keyPath, key) {\n const encoded = `${key.toString("base64url")}\n`;\n fs11.mkdirSync(path10.dirname(keyPath), { recursive: true, mode: 448 });\n try {\n const fd = fs11.openSync(keyPath, "wx", 384);\n try {\n fs11.writeFileSync(fd, encoded, "utf8");\n } finally {\n fs11.closeSync(fd);\n }\n } catch (error3) {\n if (error3.code === "EEXIST") {\n const existing = readCursorHmacKey(keyPath);\n if (existing) {\n return existing;\n

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-N4C6MQ4C.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.jsView file

165contains invisible/control Unicode U+FEFF (zero width no-break space) `,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]===`\r`&&--e,this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buff

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.jsView on unpkg · L165

dist/chunks/chunk-4GG4IOFX.jsView file

35Cross-file remote execution chain: dist/chunks/chunk-4GG4IOFX.js spawns dist/bundled/browser-use/runtime/index.js; helper contains network access plus dynamic code execution. L35: ]; L36: if (process.platform !== "win32") { L37: module.exports.push( ... L184: } L185: process14.exitCode = code || /* istanbul ignore next */ L186: 0; ... L560: function formatProdErrorMessage(code) { L561: var url = "https://react.dev/errors/" + code; L562: if (1 < arguments.length) { ... L1450: controller: new AbortControllerLocal(), L1451: data: /* @__PURE__ */ new Map(), L1452: refCount: 0

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-4GG4IOFX.jsView on unpkg · L35

dist/opentui-assets/@opentui/core-linux-x64/libopentui.soView file

•path = dist/opentui-assets/@opentui/core-linux-x64/libopentui.so kind = native_binary sizeBytes = 6268896 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/opentui-assets/@opentui/core-linux-x64/libopentui.soView on unpkg

dist/opentui-assets/web-tree-sitter/tree-sitter.wasmView file

•path = dist/opentui-assets/web-tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/opentui-assets/web-tree-sitter/tree-sitter.wasmView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1View file

•path = dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1 kind = build_helper sizeBytes = 869 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1View on unpkg

dist/chunks/dist-54LGNLWW.jsView file

•path = dist/chunks/dist-54LGNLWW.js kind = oversized_source_file sizeBytes = 5787773 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/dist-54LGNLWW.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/utilsBundle.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/coreBundle.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/tools/cli-client/channelSessions.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/tools/cli-client/program.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.jsView file

•matchType = normalized_sha256 matchedPackage = aws-runtime-bridge@1.9.153 matchedPath = node_modules/playwright-core/lib/tools/utils/extension.js matchedIdentity = npm:YXdzLXJ1bnRpbWUtYnJpZGdl:1.9.153 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.jsView on unpkg

Source & flagged code

21 flagged · loading source

dist/sandboxBwrapRelay.jsView file

1// packages/core/src/sandbox/bwrap-relay.ts L2: import { spawn } from "node:child_process"; L3: import {

High

Child Process

Package source references child process execution.

dist/sandboxBwrapRelay.jsView on unpkg · L1

dist/chunks/chunk-XRDD2MQZ.jsView file

13014var debugLogger15 = createDebugLogger("TERMINAL_SETUP"); L13015: var execAsync = promisify(exec); L13016: function stripJsonComments2(content) {

High

Shell

Package source references shell execution.

dist/chunks/chunk-XRDD2MQZ.jsView on unpkg · L13014

dist/opentui-assets/@opentui/core/parser.worker.jsView file

2319var func = `(${args}) => { ${body} };`; L2320: ASM_CONSTS[start] = eval(func); L2321: }

High

Eval

Package source references dynamic code evaluation.

dist/opentui-assets/@opentui/core/parser.worker.jsView on unpkg · L2319

1import { createRequire } from "node:module"; L2: var __require = /* @__PURE__ */ createRequire(import.meta.url); L3:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/opentui-assets/@opentui/core/parser.worker.jsView on unpkg · L1

dist/bundled/browser-use/runtime/index.jsView file

83try { L84: return "JSON.parse(" + JSON.stringify(serializeJson(value)) + ")"; L85: } catch (error) { ... L113: throw new TypeError("playwright.evaluate requires a pageFunction"); L114: return "const arg = " + serializedArg + ";\nreturn eval(" + JSON.stringify(pageFunction) + ");"; L115: } ... L979: var CDP_REQUEST_TIMEOUT_MS = 13e4; L980: function defaultChromeBridgeSocketPath(environment = process.env) { L981: const configured = environment.QWEN_BROWSER_USE_SOCKET_PATH?.trim(); L982: if (configured) return configured; L983: if (process.platform === "win32") { L984: const identity = environment.USERNAME?.replace(/[^a-zA-Z0-9_.-]/g, "_") || "default";

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/bundled/browser-use/runtime/index.jsView on unpkg · L83

dist/chunks/chunk-5NFAKADR.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-5NFAKADR.jsView on unpkg · L35

dist/chunks/server-XH67IDAZ.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/chunks/server-XH67IDAZ.jsView on unpkg · L18

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/server-XH67IDAZ.jsView on unpkg · L18

dist/chunks/chunk-N4C6MQ4C.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-N4C6MQ4C.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.jsView on unpkg · L165

dist/chunks/chunk-4GG4IOFX.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-4GG4IOFX.jsView on unpkg · L35

dist/opentui-assets/@opentui/core-linux-x64/libopentui.soView file

•path = dist/opentui-assets/@opentui/core-linux-x64/libopentui.so kind = native_binary sizeBytes = 6268896 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/opentui-assets/@opentui/core-linux-x64/libopentui.soView on unpkg

dist/opentui-assets/web-tree-sitter/tree-sitter.wasmView file

•path = dist/opentui-assets/web-tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/opentui-assets/web-tree-sitter/tree-sitter.wasmView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1View file

•path = dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1 kind = build_helper sizeBytes = 869 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1View on unpkg

dist/chunks/dist-54LGNLWW.jsView file

•path = dist/chunks/dist-54LGNLWW.js kind = oversized_source_file sizeBytes = 5787773 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/dist-54LGNLWW.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.jsView on unpkg

Findings

3 Critical11 High9 Medium8 Low

CriticalRemote Asset Decode Executedist/chunks/server-XH67IDAZ.js

CriticalEncrypted Payload Temp Executiondist/chunks/chunk-N4C6MQ4C.js

CriticalTrojan Source Unicodedist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.js

HighChild Processdist/sandboxBwrapRelay.js

HighShelldist/chunks/chunk-XRDD2MQZ.js

HighEvaldist/opentui-assets/@opentui/core/parser.worker.js

HighCommand Output Exfiltrationdist/chunks/server-XH67IDAZ.js

HighCross File Remote Execution Contextdist/chunks/chunk-4GG4IOFX.js

HighSemantic Analysis Limiteddist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.js

HighKnown Malware Source Similaritydist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.js

HighKnown Malware Source Similaritydist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.js

HighKnown Malware Source Similaritydist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.js

HighKnown Malware Source Similaritydist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.js

HighKnown Malware Source Similaritydist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.js

MediumDynamic Requiredist/opentui-assets/@opentui/core/parser.worker.js

MediumUnsafe Vm Contextdist/bundled/browser-use/runtime/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binarydist/opentui-assets/@opentui/core-linux-x64/libopentui.so

MediumShips Wasm Moduledist/opentui-assets/web-tree-sitter/tree-sitter.wasm

MediumShips Build Helperdist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1

MediumOversized Source Filedist/chunks/dist-54LGNLWW.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/chunks/chunk-5NFAKADR.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowNo License

Source & flagged code

21 flagged

dist/sandboxBwrapRelay.jsView file

Lines 1-21javascript

1// packages/core/src/sandbox/bwrap-relay.ts

2import { spawn } from "node:child_process";

3import {

High

Child Process

Package source references child process execution.

dist/sandboxBwrapRelay.jsView on unpkg · L1

4 closeSync,

5 constants,

6 createReadStream,

7 fstatSync,

8 openSync,

9 readFileSync,

10 readlinkSync,

11 unlinkSync,

12 writeFileSync

13} from "node:fs";

15// packages/core/src/sandbox/bwrap-status.ts

16var MAX_STATUS_BYTES = 16 * 1024;

17function parseBwrapStatus(wire2, exitCode) {

18 if (Buffer.byteLength(wire2) > MAX_STATUS_BYTES || !wire2.endsWith("\n")) {

19 return { state: "unconfirmed" };

20 }

21 const payloadExitObserved = wire2.trim().split("\n").some((line) => {

dist/chunks/chunk-XRDD2MQZ.jsView file

13014var debugLogger15 = createDebugLogger("TERMINAL_SETUP"); L13015: var execAsync = promisify(exec); L13016: function stripJsonComments2(content) {

High

Shell

Package source references shell execution.

dist/chunks/chunk-XRDD2MQZ.jsView on unpkg · L13014

dist/opentui-assets/@opentui/core/parser.worker.jsView file

Lines 1-21javascript

1import { createRequire } from "node:module";

2var __require = /* @__PURE__ */ createRequire(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/opentui-assets/@opentui/core/parser.worker.jsView on unpkg · L1

dist/bundled/browser-use/runtime/index.jsView file

Lines 63-103javascript

63 return value;

64}

65function timeoutOptions(options) {

66 const value = optionRecord(options, "options");

dist/chunks/chunk-5NFAKADR.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunks/chunk-5NFAKADR.jsView on unpkg · L35

dist/chunks/server-XH67IDAZ.jsView file

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/chunks/server-XH67IDAZ.jsView on unpkg · L18

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/server-XH67IDAZ.jsView on unpkg · L18

dist/chunks/chunk-N4C6MQ4C.jsView file

Critical

Encrypted Payload Temp Execution

Source decrypts an embedded payload, writes it to disk, and executes it through a child process.

dist/chunks/chunk-N4C6MQ4C.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/vite/traceViewer/assets/defaultSettingsView-B-dXF5JN.jsView on unpkg · L165

dist/chunks/chunk-4GG4IOFX.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-4GG4IOFX.jsView on unpkg · L35

dist/opentui-assets/@opentui/core-linux-x64/libopentui.soView file

•path = dist/opentui-assets/@opentui/core-linux-x64/libopentui.so kind = native_binary sizeBytes = 6268896 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/opentui-assets/@opentui/core-linux-x64/libopentui.soView on unpkg

dist/opentui-assets/web-tree-sitter/tree-sitter.wasmView file

•path = dist/opentui-assets/web-tree-sitter/tree-sitter.wasm kind = wasm_module sizeBytes = 205488 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/opentui-assets/web-tree-sitter/tree-sitter.wasmView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1View file

•path = dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1 kind = build_helper sizeBytes = 869 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/bundled/browser-use/runtime/node_modules/playwright-core/bin/reinstall_msedge_dev_win.ps1View on unpkg

dist/chunks/dist-54LGNLWW.jsView file

•path = dist/chunks/dist-54LGNLWW.js kind = oversized_source_file sizeBytes = 5787773 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/chunks/dist-54LGNLWW.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 10

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/utilsBundle.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/coreBundle.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/channelSessions.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/cli-client/program.jsView on unpkg

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bundled/browser-use/runtime/node_modules/playwright-core/lib/tools/utils/extension.jsView on unpkg

@zubriq/code@0.24.4-1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code