ai-claude-keyapi@1.0.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

ai-claude-keyapi@1.0.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

dist/server.jsView file

2var ef=Object.create;var Qo=Object.defineProperty;var af=Object.getOwnPropertyDescriptor;var nf=Object.getOwnPropertyNames;var tf=Object.getPrototypeOf,of=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function df(a){if(!a)throw new TypeError("argument namespace is required");var e=hi(),i=Ye(e[1]),n=i[0];function t(o){xi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Rn(e)),t}function hf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var ef=Object.create;var Qo=Object.defineProperty;var af=Object.getOwnPropertyDescriptor;var nf=Object.getOwnPropertyNames;var tf=Object.getPrototypeOf,of=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function df(a){if(!a)throw new TypeError("argument namespace is required");var e=hi(),i=Ye(e[1]),n=i[0];function t(o){xi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Rn(e)),t}function hf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

5at `+i[o].toString();return t}return e&&(t+=" at "+Rn(e)),t}function hf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Rn(e)+"\x1B[39m"),n}function Rn(a){return rf(cf,a[0])+":"+a[1]+":"+a[2]}function hi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

12const serverPath = fs.existsSync(distServer) ? distServer : path.join(__dirname, '../src/server.js'); L13: const { startServer } = await import(serverPath); L14:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L12

dist/utils/shortcut.jsView file

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: import n from"node:fs";import i from"node:path";import m from"node:os";function k(s={}){let l=s.homeDir||m.homedir(),u=s.platform||process.platform,o=s.env||process.env,d=u==="win3... L3: where ai-claude-keyapi >nul 2>&1\r ... L15: fi L16: `,{mode:493}),c.installed=!0,c.paths.push(e)}catch{}let a=[".bashrc",".zshrc",".profile"].map(e=>i.join(l,e)),r=` L17: # AI Claude KeyAPI shortcut

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/utils/shortcut.jsView on unpkg · L1

Source & flagged code

5 flagged

dist/server.jsView file

2var ef=Object.create;var Qo=Object.defineProperty;var af=Object.getOwnPropertyDescriptor;var nf=Object.getOwnPropertyNames;var tf=Object.getPrototypeOf,of=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function df(a){if(!a)throw new TypeError("argument namespace is required");var e=hi(),i=Ye(e[1]),n=i[0];function t(o){xi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Rn(e)),t}function hf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";retu

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/server.jsView on unpkg · L2

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url); L2: var ef=Object.create;var Qo=Object.defineProperty;var af=Object.getOwnPropertyDescriptor;var nf=Object.getOwnPropertyNames;var tf=Object.getPrototypeOf,of=Object.prototype.hasOwnPr... L3: at `+a[i].toString();return e}function df(a){if(!a)throw new TypeError("argument namespace is required");var e=hi(),i=Ye(e[1]),n=i[0];function t(o){xi.call(t,o)}return t._file=n,t.... L4: `,"utf8")}}}function Ye(a){var e=a.getFileName()||"<anonymous>",i=a.getLineNumber(),n=a.getColumnNumber();a.isEval()&&(e=a.getEvalOrigin()+", "+e);var t=[e,i,n];return t.callSite=a... L5: at `+i[o].toString();return t}return e&&(t+=" at "+Rn(e)),t}function hf(a,e,i){var n="\x1B[36;1m"+this._namespace+

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/server.jsView on unpkg · L1

5at `+i[o].toString();return t}return e&&(t+=" at "+Rn(e)),t}function hf(a,e,i){var n="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+a+"\x1B[39m"... L6: \x1B[36mat `+i[t].toString()+"\x1B[39m";return n}return e&&(n+=" \x1B[36m"+Rn(e)+"\x1B[39m"),n}function Rn(a){return rf(cf,a[0])+":"+a[1]+":"+a[2]}function hi(){var a=Error.stackTr... L7: return function (`+i+`) {log.call(deprecate, message, site)

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/server.jsView on unpkg · L5

bin/cli.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2

3import fs from 'node:fs';

4import path from 'node:path';

5import { fileURLToPath } from 'node:url';

6

7const

dist/utils/shortcut.jsView file

Lines 1-20javascript

1import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);

2import n from"node:fs";import i