bridge-agent@0.18.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

bridge-agent@0.18.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

1#!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Critical

Spawned Remote Code Execution

Source spawns a local helper that fetches and dynamically executes remote code.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Critical

Remote Asset Decode Execute

Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.

dist/index.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> dist/index.js L1: #!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefaul

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L1

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L10

32|| (${s} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,ae._)`+${o}`);return;case"boolean":n.elseIf((0,ae._)`${o} === "false" || ${o} === 0 || ${o} === null`).... L33: || ${s} === "boolean" || ${o} === null`).assign(a,(0,ae._)`[${o}]`)}}}function nM({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,ae._)`${e} !== undefined`,()=>t.assign((0,ae.... L34: missingProperty: ${n},

High

Eval

Package source references dynamic code evaluation.

dist/index.jsView on unpkg · L32

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Kv(t){r...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L10

10(Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidden)&&(e._hidden=!0),this._registerComma... ... L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Kv(t){r...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L10

1#!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/index.jsView on unpkg · L1

22package = bridge-agent; repositoryIdentity = jerico; dependency = node-pty L22: Expecting one of '${n.join("', '")}'`);let o=`${e}Help`;return this.on(o,i=>{let s;typeof r=="function"?s=r({error:i.error,command:i.command}):s=r,s&&i.write(`${s} L23: `)}),this}_outputHelpIfRequested(e){let r=this._getHelpOption();r&&e.find(o=>r.is(o))&&(this.outputHelp(),this._exit(0,"commander.helpDisplayed","(outputHelp)"))}};function Kv(t){r... L24: `).join(`\r

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/index.jsView on unpkg · L22

1Cross-file remote execution chain: dist/index.js spawns dist/bridge-mcp.cjs; helper contains network access plus dynamic code execution. L1: #!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - spe

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L1

466Type "yes" to continue: `);let e="";process.stdin.setEncoding("utf-8"),process.stdin.resume(),process.stdin.on("data",r=>{e+=r,e.includes(` L467: `)&&(process.stdin.pause(),t(e.trim().toLowerCase()==="yes"))})})}var Lv=A(require("path")),oO=require("node:os");_t();var HZ=Lv.default.join((0,oO.homedir)(),"Library","LaunchAgen...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L466

1#!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var fO=Object.create;var Gd=Object.defineProperty;var mO=Object.getOwnPropertyDescriptor;var hO=Object.getOwnPropertyNames;var gO=Object.getPrototypeOf,yO=Object.proto... L3: `).replace(/^/gm," ".repeat(i))}let l=[`Usage: ${r.commandUsage(e)}`,""],u=r.commandDescription(e);u.length>0&&(l=l.concat([r.wrap(u,o,0),""]));let d=r.visibleArguments(e).map(m=>a... ... L10: (Did you mean one of ${n.join(", ")}?)`:n.length===1?` L11: (Did you mean ${n[0]}?)`:""}Gv.suggestSimilar=IO});var Xv=E(Yv=>{var EO=require("node:events").EventEmitter,np=require("node:child_process"),Gr=require("node:path"),op=require("nod... L12: - specify the name in Command constructor or using .name()`);return r=r||{},r.isDefault&&(this._defaultCommandName=e._name),(r.noHelp||r.hidde

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L1

dist/scripts/install-sim-prereqs.shView file

•path = dist/scripts/install-sim-prereqs.sh kind = build_helper sizeBytes = 5367 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/scripts/install-sim-prereqs.shView on unpkg