blokctl@2.5.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

blokctl@2.5.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged · loading source

dist/index.jsView file

1#!/usr/bin/env node L2: import child_process from "node:child_process"; L3: import os from "node:os";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

1Cross-file remote execution chain: dist/index.js spawns dist/commands/create/project.js; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: import child_process from "node:child_process"; L3: import os from "node:os"; ... L49: const execResponse = await exec(`npm view ${CLI_NAME} version`); L50: latestVersion = execResponse.stdout.trim(); L51: } ... L71: try { L72: const HOME_DIR = `${os.homedir()}/.blok`; L73: const cliConfigPath = `${HOME_DIR}/blokctl.json`; ... L192: .option("-f, --framework <value>", "Frontend framework: react, vue, svelte") L193: .option("--blok-url <url>", "Blok server the dev proxy forwards to (default: http://localhost:4000)") L194: .option("--pm <value>", "Package manager: npm, yarn, pnpm, bun")

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView file

401const packageName = "@blokjs/browser"; L402: const browser = (await import(packageName)) as { L403: browserSessionManager: {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/scaffold-repo/triggers/websocket/src/WebSocketTrigger.tsView on unpkg · L401

dist/commands/inertia/ssr.jsView file

1import { spawn, spawnSync } from "node:child_process"; L2: import { existsSync, readFileSync } from "node:fs"; L3: import { isAbsolute, join, resolve } from "node:path"; L4: const DEFAULT_URL = "http://127.0.0.1:13714"; L5: function enabled() { L6: return !["0", "false", "off", "no"].includes((process.env.BLOK_INERTIA_SSR_ENABLED ?? "true").toLowerCase()); L7: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/inertia/ssr.jsView on unpkg · L1

dist/services/posthog.jsView file

9version; L10: constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) { L11: this.version = version; ... L13: try { L14: const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8")); L15: this.distinctId = distinctId; ... L57: isTelemetryEnabled() { L58: if (process.env.NO_NANOCTL_TELEMETRY) { L59: return false; ... L63: getDistinctId() { L64: const machineId = os.hostname(); L65: return `blokctl-${machineId}`;

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/services/posthog.jsView on unpkg · L9

9Trigger-reachable chain: manifest.main -> dist/index.js -> dist/services/posthog.js L9: version; L10: constructor({ version, apiKey = "phc_2xrtQviE7fuks4uth84sqTIq7gOErCX7FOATRjHjzBa", host = "https://us.i.posthog.com", cliConfigPath, }) { L11: this.version = version; ... L13: try { L14: const { distinctId, sessionId } = JSON.parse(readFileSync(cliConfigPath, "utf-8")); L15: this.distinctId = distinctId; ... L57: isTelemetryEnabled() { L58: if (process.env.NO_NANOCTL_TELEMETRY) { L59: return false; ... L63: getDistinctId() { L64: const machineId = os.hostname(); L65: return `blokctl-${machineId}`;

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/services/posthog.jsView on unpkg · L9

dist/scaffold-repo/sdks/python3/bin/worker.pyView file

•path = dist/scaffold-repo/sdks/python3/bin/worker.py kind = build_helper sizeBytes = 2018 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scaffold-repo/sdks/python3/bin/worker.pyView on unpkg

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView file

•path = dist/scaffold-repo/sdks/python3/tests/test_grpc_server.py kind = payload_in_excluded_dir sizeBytes = 16689 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

dist/scaffold-repo/sdks/python3/tests/test_grpc_server.pyView on unpkg

dist/commands/create/spa.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/create/spa.js#virtual:normalized:round1View on unpkg

dist/commands/build/index.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/commands/build/index.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/build/index.jsView on unpkg

dist/commands/create/node.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/commands/create/node.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/create/node.jsView on unpkg

dist/commands/dev/index.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/commands/dev/index.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/dev/index.jsView on unpkg

dist/commands/install/node.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/commands/install/node.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/install/node.jsView on unpkg

dist/commands/publish/node.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/commands/publish/node.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/publish/node.jsView on unpkg

dist/commands/routes/index.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/commands/routes/index.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/routes/index.jsView on unpkg

dist/services/js-worker.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = dist/services/js-worker.js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/js-worker.jsView on unpkg

dist/commands/generate/NodeFileWriter.jsView file

•matchType = normalized_sha256 matchedPackage = blokctl@2.3.0 matchedPath = [redacted].js matchedIdentity = npm:Ymxva2N0bA:2.3.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/generate/NodeFileWriter.jsView on unpkg

dist/commands/create/project.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blokctl@2.2.1 matchedIdentity = npm:Ymxva2N0bA:2.2.1 similarity = 0.767 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/create/project.jsView on unpkg