automation-tool-manager: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

automation-tool-manager: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.preinstall = node ./scripts/check-node.js && node ./scripts/preinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

jdeploy-bundle/jdeploy.jsView file

5var fs = require('fs'); L6: var child_process = require('child_process'); L7: var port = "8085";

High

Child Process

Package source references child process execution.

jdeploy-bundle/jdeploy.jsView on unpkg · L5

scripts/postinstall.jsView file

8Cross-file remote execution chain: scripts/postinstall.js spawns jdeploy-bundle/jdeploy.js; helper contains network access plus dynamic code execution. L8: L9: const { spawnSync } = require('child_process'); L10: const fs = require('fs'); ... L13: L14: const scriptDir = __dirname; L15: const setupSh = path.join(scriptDir, 'setup.sh'); ... L30: args.includes('--skip-browsers') || L31: process.env.AUTOMATION_SKIP_BROWSERS === '1' || L32: process.env.CI === 'true'; L33: ... L75: // Not a TTY (npm install without --foreground-scripts) → default silently. L76: if (!process.stdin.isTTY && !process.stdout.isTTY) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.jsView on unpkg · L8

scripts/setup.shView file

•path = scripts/setup.sh kind = build_helper sizeBytes = 51288 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup.shView on unpkg

jdeploy-bundle/jar-runner.jarView file

•path = jdeploy-bundle/jar-runner.jar kind = compressed_blob sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/jar-runner.jarView on unpkg

•path = jdeploy-bundle/jar-runner.jar kind = nested_archive_needs_inspection sizeBytes = 1839 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/jar-runner.jarView on unpkg

jdeploy-bundle/tool-manager-1.9.23.jarView file

•path = jdeploy-bundle/tool-manager-1.9.23.jar kind = high_entropy_blob sizeBytes = 34122695 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.9.23.jarView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 17-45json

17 "javaVersion": "17",

18 "jar": "target/tool-manager-1.9.23.jar",

19 "javafx": false,

20 "title": "Automation Agent"

21 },

22 "files": [

23 "jdeploy-bundle",

24 "scripts",

25 "target/tool-manager-1.9.23.jar"

26 ],

27 "dependencies": {},

28 "devDependencies": {

29 "@vitejs/plugin-react": "^4.3.4",

30 "vite": "^6.0.0"

31 },

32 "engines": {

33 "node": ">=18"

34 },

35 "scripts": {

36 "test": "echo \"Error: no test specified\" && exit 1",

37 "preinstall": "node ./scripts/check-node.js && node ./scripts/preinstall.js",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 "postinstall": "node ./scripts/postinstall.js || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L38

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L38

39 "setup": "node ./scripts/postinstall.js",

40 "setup:full": "node ./scripts/postinstall.js --full",

41 "setup:skip-browsers": "node ./scripts/postinstall.js --skip-browsers",

42 "reinstall": "npm install -g --force --no-audit --no-fund"

43 }

44}

45

jdeploy-bundle/jdeploy.jsView file

Lines 1-25javascript

1#! /usr/bin/env node

2

3var path = require('path');

4var os = require('os');

5var fs = require(

scripts/postinstall.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2// postinstall: installs Java/Maven/browsers via setup scripts.

3// Design goals:

4// - `npm install` must NEVER fail or hang because of this script.

5// - Non-interactive by default (npm runs without a TTY prompt).

6// - Full interactive setup still available via: npm run setup:full

7// Runtime (jdeploy.js) needs ZERO npm dependencies - only Node built-ins.

8

9const { spawnSync } =

scripts/setup.shView file

•path = scripts/setup.sh kind = build_helper sizeBytes = 51288 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/setup.shView on unpkg

jdeploy-bundle/jar-runner.jarView file

•path = jdeploy-bundle/jar-runner.jar kind = compressed_blob sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

jdeploy-bundle/jar-runner.jarView on unpkg

•path = jdeploy-bundle/jar-runner.jar kind = nested_archive_needs_inspection sizeBytes = 1839 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

jdeploy-bundle/jar-runner.jarView on unpkg

jdeploy-bundle/tool-manager-1.9.23.jarView file

•path = jdeploy-bundle/tool-manager-1.9.23.jar kind = high_entropy_blob sizeBytes = 34122695 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

jdeploy-bundle/tool-manager-1.9.23.jarView on unpkg