Loading npm security reports…

batmanuel@0.0.6: Suspicious npm security report (Warn) | LPM Firewall

registry / batmanuel / 0.0.6

batmanuel@0.0.6

Batmanuel - A code quality analysis tool

AI Security Review

scanned 2h ago · by lpm-firewall-ai

When the HTTP service is started, any requester can obtain the mock token and submit a ZIP archive for extraction and scanning. This is a concrete untrusted-archive processing risk, not confirmed malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

User starts `src/main.js`; requester calls `POST /auth/token` then `POST /analyze/upload`.

Impact

Potential denial-of-service or archive path-handling exposure; no confirmed code execution or data exfiltration.

Mechanism

public mock authentication followed by ZIP extraction and filesystem scanning

Rationale

No source evidence indicates malware or install-time compromise. Warn for the exposed mock authentication and untrusted ZIP extraction surface.

Evidence

package.jsonsrc/main.jssrc/bin/cli.jssrc/auth/auth.controller.jssrc/auth/token.guard.jssrc/analyze/analyze.controller.jssrc/analyze/analyze.service.jssrc/engines/dependency-scanner.service.js

Network endpoints1

api.osv.dev/v1/querybatch

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with medium false-positive risk.

Evidence for warning

`src/auth/auth.controller.js` publicly returns a fixed bearer token.
`src/auth/token.guard.js` accepts that same fixed token.
`src/analyze/analyze.controller.js` permits authenticated ZIP uploads.
`src/analyze/analyze.service.js` writes and extracts untrusted archives.
Archive extraction has no visible entry-count or expanded-size limit.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare hook.
`src/bin/cli.js` runs only when the user invokes the CLI.
No child-process, eval/vm, dynamic loader, or native-binary execution found.
The only network call posts dependency metadata to OSV.
No credential harvesting, AI-agent mutation, persistence, or exfiltration found.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 54.3 KB of source, external domains: api.osv.dev

Source & flagged code

4 flagged

src/auth/auth.controller.jsView file

•Published source reference

Medium

Ai Review Evidence

`src/auth/auth.controller.js` publicly returns a fixed bearer token.

src/auth/auth.controller.jsView on unpkg

src/auth/token.guard.jsView file

•Published source reference

Medium

Ai Review Evidence

`src/auth/token.guard.js` accepts that same fixed token.

src/auth/token.guard.jsView on unpkg

src/analyze/analyze.controller.jsView file

•Published source reference

Medium

Ai Review Evidence

`src/analyze/analyze.controller.js` permits authenticated ZIP uploads.

Source & flagged code

4 flagged · loading source

src/auth/auth.controller.jsView file

•Published source reference

Medium

Ai Review Evidence

`src/auth/auth.controller.js` publicly returns a fixed bearer token.

src/auth/auth.controller.jsView on unpkg

src/auth/token.guard.jsView file

•Published source reference

Medium

Ai Review Evidence

`src/auth/token.guard.js` accepts that same fixed token.

src/auth/token.guard.jsView on unpkg

src/analyze/analyze.controller.jsView file

•Published source reference

Medium

Ai Review Evidence

Findings

7 Medium3 Low

MediumNetwork

MediumEnvironment Vars

MediumAi Review Evidencesrc/auth/auth.controller.js

MediumAi Review Evidencesrc/auth/token.guard.js

MediumAi Review Evidencesrc/analyze/analyze.controller.js

MediumAi Review Evidencesrc/analyze/analyze.service.js

MediumAi Review Evidence

LowScripts Present

LowFilesystem

LowUrl Strings