blun-king-cli@9.1.589: Suspicious npm security report (Warn)

Loading npm security reports…

blun-king-cli@9.1.589: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty-perms.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/update-lease.jsView file

7const path = require('node:path'); L8: const { spawn } = require('node:child_process'); L9:

High

Child Process

Package source references child process execution.

bin/update-lease.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/update-lease.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/update-lease.jsView on unpkg

agent-spine-plugin/scripts/check-hosts.jsView file

High

Shell

Package source references shell execution.

agent-spine-plugin/scripts/check-hosts.jsView on unpkg · L7

telegram-plugin/dist/mcp-server.mjsView file

168try { L169: new Function(""); L170: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/dist/mcp-server.mjsView on unpkg · L168

bin/node-runtime.jsView file

2L3: const { ensureManagedNode } = require('./managed-node'); L4: const { unsupportedNodeMessage } = require('./node-version');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/node-runtime.jsView on unpkg · L2

bin/verify-agent-behavior.cjsView file

14function verifyAgentBehavior(packageRoot, reportParent) { L15: const parent = reportParent || path.join(os.homedir(), '.blun', 'diagnostics', 'package-contracts'); L16: fs.mkdirSync(parent, { recursive: true }); ... L23: }; L24: const read = file => JSON.parse(fs.readFileSync(file, 'utf8')); L25: const core = fs.readFileSync(path.join(packageRoot, 'blun.mjs'), 'utf8'); ... L93: assert.equal(gate({ ...message, replyToUsername: 'ExampleBot' }, 'ExampleBot').action, 'deliver'); L94: assert.equal(gate({ ...message, chatType: 'private', chatId: 'operator' }, 'ExampleBot').action, 'deliver'); L95: passed.push('registered-bridge-drops-unmentioned-groups-preserves-mentions-replies-dms');

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

bin/verify-agent-behavior.cjsView on unpkg · L14

telegram-plugin/dist/bridge.mjsView file

5import { homedir } from "node:os"; L6: import { spawn } from "node:child_process"; L7: import { Readable, Writable } from "node:stream"; ... L35: * Check out the L36: * [documentation](https://grammy.dev/ref/core/composer#on) L37: * of `bot.on` for examples. In addition, the ... L219: is_upgrade_separate: {}, L220: is_private: {} L221: }; ... L284: video_chat_participants_invited: {}, L285: web_app_data: {} L286: };

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L5

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/language_gateway.pyView file

•path = standard-tools/language-guard/language_gateway.py kind = build_helper sizeBytes = 2426 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/language_gateway.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 21216699 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 21216699 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/managed-node.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

•matchType = token_shingles matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/scripts/run-checks.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/src/lib/peer-transport.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = agent-spine-plugin/src/lib/sqlite-transport.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = bin/node-version.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

dist-web/assets/cytoscape.esm-nFXppDBa.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.200 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.200 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/cytoscape.esm-nFXppDBa.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = dist-web/assets/diagram-Q27KOJAE-hy_T73PK.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView on unpkg

dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.jsView file

•matchType = normalized_sha256 matchedPackage = blun-king-cli@9.1.519 matchedPath = dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.js matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.519 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.jsView on unpkg

dist-web/assets/flowDiagram-UKHOOZJN-Z83i2UWI.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/flowDiagram-UKHOOZJN-Z83i2UWI.jsView on unpkg

bin/update-notice.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = blun-king-cli@9.1.588 matchedIdentity = npm:Ymx1bi1raW5nLWNsaQ:9.1.588 similarity = 0.992 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/update-notice.jsView on unpkg

Source & flagged code

26 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty-perms.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/update-lease.jsView file

7const path = require('node:path'); L8: const { spawn } = require('node:child_process'); L9:

High

Child Process

Package source references child process execution.

bin/update-lease.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/update-lease.jsView on unpkg

agent-spine-plugin/scripts/check-hosts.jsView file

High

Shell

Package source references shell execution.

agent-spine-plugin/scripts/check-hosts.jsView on unpkg · L7

telegram-plugin/dist/mcp-server.mjsView file

168try { L169: new Function(""); L170: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/dist/mcp-server.mjsView on unpkg · L168

bin/node-runtime.jsView file

2L3: const { ensureManagedNode } = require('./managed-node'); L4: const { unsupportedNodeMessage } = require('./node-version');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/node-runtime.jsView on unpkg · L2

bin/verify-agent-behavior.cjsView file

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

bin/verify-agent-behavior.cjsView on unpkg · L14

telegram-plugin/dist/bridge.mjsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L5

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/language_gateway.pyView file

•path = standard-tools/language-guard/language_gateway.py kind = build_helper sizeBytes = 2426 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/language_gateway.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 21216699 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 21216699 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

dist-web/assets/cytoscape.esm-nFXppDBa.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/cytoscape.esm-nFXppDBa.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView on unpkg

dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.jsView on unpkg

dist-web/assets/flowDiagram-UKHOOZJN-Z83i2UWI.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/flowDiagram-UKHOOZJN-Z83i2UWI.jsView on unpkg

bin/update-notice.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/update-notice.jsView on unpkg

Source & flagged code

26 flagged

package.jsonView file

•scripts.postinstall = node scripts/fix-node-pty-perms.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/update-lease.jsView file

7const path = require('node:path'); L8: const { spawn } = require('node:child_process'); L9:

High

Child Process

Package source references child process execution.

bin/update-lease.jsView on unpkg · L7

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/update-lease.jsView on unpkg

agent-spine-plugin/scripts/check-hosts.jsView file

High

Shell

Package source references shell execution.

agent-spine-plugin/scripts/check-hosts.jsView on unpkg · L7

telegram-plugin/dist/mcp-server.mjsView file

168try { L169: new Function(""); L170: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

telegram-plugin/dist/mcp-server.mjsView on unpkg · L168

bin/node-runtime.jsView file

2L3: const { ensureManagedNode } = require('./managed-node'); L4: const { unsupportedNodeMessage } = require('./node-version');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/node-runtime.jsView on unpkg · L2

bin/verify-agent-behavior.cjsView file

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

bin/verify-agent-behavior.cjsView on unpkg · L14

telegram-plugin/dist/bridge.mjsView file

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

telegram-plugin/dist/bridge.mjsView on unpkg · L5

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView file

•path = native/darwin/prebuilds/darwin-x64/darwin-modifiers.node kind = native_binary sizeBytes = 12776 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

native/darwin/prebuilds/darwin-x64/darwin-modifiers.nodeView on unpkg

standard-tools/language-guard/language_gateway.pyView file

•path = standard-tools/language-guard/language_gateway.py kind = build_helper sizeBytes = 2426 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

standard-tools/language-guard/language_gateway.pyView on unpkg

dist-web/vis/index.html.gzView file

•path = dist-web/vis/index.html.gz kind = high_entropy_blob sizeBytes = 125235 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist-web/vis/index.html.gzView on unpkg

•path = dist-web/vis/index.html.gz kind = compressed_blob sizeBytes = 125235 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist-web/vis/index.html.gzView on unpkg

blun.mjsView file

•path = blun.mjs kind = oversized_source_file sizeBytes = 21216699 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

blun.mjsView on unpkg

•path = blun.mjs kind = oversized_cli_entrypoint sizeBytes = 21216699 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

blun.mjsView on unpkg

agent-spine-plugin/scripts/check-install.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

agent-spine-plugin/scripts/check-install.jsView on unpkg

bin/managed-node.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/managed-node.jsView on unpkg

agent-spine-plugin/scripts/run-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/scripts/run-checks.jsView on unpkg

agent-spine-plugin/src/lib/peer-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/peer-transport.jsView on unpkg

agent-spine-plugin/src/lib/sqlite-transport.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

agent-spine-plugin/src/lib/sqlite-transport.jsView on unpkg

bin/node-version.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/node-version.jsView on unpkg

dist-web/assets/cytoscape.esm-nFXppDBa.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/cytoscape.esm-nFXppDBa.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-D1mYQ_cI.jsView on unpkg

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/diagram-Q27KOJAE-hy_T73PK.jsView on unpkg

dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/flowDiagram-UKHOOZJN-D9wBbHm2.jsView on unpkg

dist-web/assets/flowDiagram-UKHOOZJN-Z83i2UWI.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-web/assets/flowDiagram-UKHOOZJN-Z83i2UWI.jsView on unpkg

bin/update-notice.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/update-notice.jsView on unpkg

blun-king-cli@9.1.589

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code