blokctl@2.2.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

blokctl@2.2.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/index.jsView file

1#! /usr/bin/env bun L2: import child_process from "node:child_process"; L3: import os from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1Cross-file remote execution chain: dist/index.js spawns dist/commands/create/project.js; helper contains network access plus dynamic code execution. L1: #! /usr/bin/env bun L2: import child_process from "node:child_process"; L3: import os from "node:os"; ... L46: const execResponse = await exec(`npm view ${CLI_NAME} version`); L47: latestVersion = execResponse.stdout.trim(); L48: } ... L68: try { L69: const HOME_DIR = `${os.homedir()}/.blok`; L70: const cliConfigPath = `${HOME_DIR}/blokctl.json`;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView file

401const packageName = "@blokjs/browser"; L402: const browser = (await import(packageName)) as { L403: browserSessionManager: {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView on unpkg · L401

dist/services/posthog.jsView file

9version; L10: constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) { L11: this.version = version; ... L13: try { L14: const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8")); L15: this.distinctId = distinctId; ... L57: isTelemetryEnabled() { L58: if (process.env.NO_NANOCTL_TELEMETRY) { L59: return false; ... L63: getDistinctId() { L64: const machineId = os.hostname(); L65: return `blokctl-${machineId}`;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/posthog.jsView on unpkg · L9

9Trigger-reachable chain: manifest.main -> dist/index.js -> dist/services/posthog.js L9: version; L10: constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) { L11: this.version = version; ... L13: try { L14: const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8")); L15: this.distinctId = distinctId; ... L57: isTelemetryEnabled() { L58: if (process.env.NO_NANOCTL_TELEMETRY) { L59: return false; ... L63: getDistinctId() { L64: const machineId = os.hostname(); L65: return `blokctl-${machineId}`;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/services/posthog.jsView on unpkg · L9

dist/scaffold-repo/sdks/python3/bin/worker.pyView file

•path = dist/scaffold-repo/sdks/python3/bin/worker.py kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scaffold-repo/sdks/python3/bin/worker.pyView on unpkg

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView file

•path = dist/scaffold-repo/sdks/python3/tests/test_grpc_server.py kind = payload_in_excluded_dir sizeBytes = 16016 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView on unpkg

dist/commands/generate/NodeFileWriter.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.0.1 matchedPath = [redacted].js matchedIdentity = npm:Ymxva2N0bA:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/generate/NodeFileWriter.jsView on unpkg

dist/commands/create/project.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blokctl@1.4.1 matchedIdentity = npm:Ymxva2N0bA:1.4.1 similarity = 0.367 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/create/project.jsView on unpkg

Source & flagged code

9 flagged

dist/index.jsView file

Lines 1-21javascript

1#! /usr/bin/env bun

2import child_process from "node:child_process";

3import os from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

4import util from "node:util";

5import * as p from "@clack/prompts";

6import fsExtra from "fs-extra";

7import color from "picocolors";

8import { checkProject } from "./commands/check/index.js";

9import { createNode } from "./commands/create/node.js";

10import { createProject } from "./commands/create/project.js";

11import { createWorkflow } from "./commands/create/workflow.js";

12import { devProject } from "./commands/dev/index.js";

13import { program, withErrorBoundary } from "./services/commander.js";

14import { setNonInteractive } from "./services/non-interactive.js";

15import { PosthogAnalytics } from "./services/posthog.js";

16import { getPackageVersion } from "./services/utils.js";

17import "./commands/login/index.js";

18import "./commands/logout/index.js";

19import "./commands/build/index.js";

20import "./commands/deploy/index.js";

21import "./commands/monitor/index.js";

dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView file

Lines 381-421typescript

381

382 return {

383 onOpen: (_event, ws) => {

384 void (async () => {

385 const

dist/services/posthog.jsView file

Lines 1-29javascript

1import { randomUUID } from "node:crypto";

2import { existsSync, readFileSync, writeFileSync } from "node:fs";

3import os from "node:os";

4import { PostHog } from "posthog-node";

dist/scaffold-repo/sdks/python3/bin/worker.pyView file

•path = dist/scaffold-repo/sdks/python3/bin/worker.py kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scaffold-repo/sdks/python3/bin/worker.pyView on unpkg

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView file

•path = dist/scaffold-repo/sdks/python3/tests/test_grpc_server.py kind = payload_in_excluded_dir sizeBytes = 16016 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView on unpkg

dist/commands/generate/NodeFileWriter.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.0.1 matchedPath = [redacted].js matchedIdentity = npm:Ymxva2N0bA:2.0.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/generate/NodeFileWriter.jsView on unpkg

dist/commands/create/project.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blokctl@1.4.1 matchedIdentity = npm:Ymxva2N0bA:1.4.1 similarity = 0.367 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/create/project.jsView on unpkg