Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

bucket@0.2.0: Suspicious npm security report (Warn) | LPM Firewall

Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Flagged — allowed with a warning

Allowed by default policy, but 11 finding(s) warrant review before installing.

View on npm All versions

registry / bucket / 0.2.0

bucket@0.2.0

Access any of the popular file storage solutions with a unified API

AI Security Review

scanned 8h ago · by lpm-firewall-ai

The FileSystem provider has a command-injection vulnerability in its MIME-type lookup. It is reached only when application code calls file.info() with an attacker-controlled path.

Static reason

One or more suspicious static signals were detected.

Trigger

An application passes attacker-controlled input to FileSystem(...).file(name).info().

Impact

Arbitrary command execution with the hosting application's privileges.

Mechanism

Unsafely interpolated path in child_process.exec shell command.

Rationale

The package is not malicious, but it contains a concrete arbitrary-command-execution vulnerability in an exposed API. Its cloud credential handling is aligned with the documented storage-provider functionality.

Evidence

package.jsondist/chunk-CW7I23PJ.jsreadme.md

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/chunk-CW7I23PJ.js passes a file path into child_process.exec.
The path is interpolated inside single quotes without escaping.
FSFile.info() invokes that command, allowing shell metacharacter injection via a supplied filename.

© 2026 LPM Firewall

Product

Threat feed How it works Policy

LPM

LPM.dev Registry

Evidence against

package.json has only a prepare build hook; no install/postinstall hook.
Cloud credential and metadata requests implement documented S3/GCS/Azure authentication.
No import-time network request, persistence, or credential exfiltration path was found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 51 file(s), 433 KB of source, external domains: 169.254.169.254, 169.254.170.2, api.backblazeb2.com, metadata.google.internal, oauth2.googleapis.com, storage.azure.com, storage.googleapis.com, www.googleapis.com

Source & flagged code

3 flagged · loading source

dist/chunk-GESPR7MT.jsView file

61const url = bucket.base + "file/" + bucket.name + "/" + this.path; L62: const res = await this.#bucket.fetch(url); L63: return res.text(); L64: } ... L111: const res2 = await this.#bucket.fetch(auth.uploadUrl, { L112: body: data, L113: method: "POST", ... L236: B2_APPLICATION_KEY: ENV_KEY L237: } = process.env; L238: var BackBlazeInstance = class {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-GESPR7MT.jsView on unpkg · L61

dist/chunk-MUR3Y2RD.jsView file

8promiseToWritable, L9: sha256base64 L10: } from "./chunk-JLKDR735.js"; ... L95: const res = await this.#ctx.doRequest("PUT", this.path, { L96: body: data, L97: headers ... L188: AWS_ENDPOINT: ENV_ENDPOINT L189: } = process.env; L190: async function fetchInstanceCredentials(region) { ... L195: if (token) headers["Authorization"] = token; L196: const res = await fetch(fullUri, { headers }); L197: if (!res.ok) throw new Error("Failed to fetch container credentials");

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/chunk-MUR3Y2RD.jsView on unpkg · L8

dist/chunk-JVZSKCSS.jsView file

7sha256hex, L8: toBase64Url, L9: toHex ... L23: iss: auth.clientEmail, L24: scope: "https://www.googleapis.com/auth/devstorage.read_write", L25: aud: "https://oauth2.googleapis.com/token", ... L28: }); L29: const key = await importRsaPkcs8(auth.privateKey); L30: const signature = toBase64Url(await rsaSha256(key, `${header}.${payload}`)); ... L34: headers: { "Content-Type": "application/x-www-form-urlencoded" }, L35: body: new URLSearchParams({ L36: grant_type: "urn:ietf:params:oauth:grant-type:jwt-bearer",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-JVZSKCSS.jsView on unpkg · L7

Findings

2 High3 Medium6 Low

HighCredential Exfiltrationdist/chunk-MUR3Y2RD.js

HighCloud Metadata Accessdist/chunk-JVZSKCSS.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/chunk-GESPR7MT.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

95%Warn

Verdict confidence

IntentCritical Vulnerability

TypeRemote Code Execution

False-positive riskLow

Review stagesource_first_review

Firewall policyMatched warn-list

Package metadata

npm

AuthorFrancisco Presencia

Maintainersalexbosworth, franciscop

Version0.4.0

PublishedJul 4, 2026

LicenseMIT

Dependencies0

Integrityverified

Package size88.3 KB

Files65

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → ./dist/index.jstypes → ./dist/index.d.tsexports map

RuntimeNo engine / OS / CPU constraints

Artifact512 KB · 65 files1 signature(s)

Install lifecycleprepare

Behavioral surface

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

LPM CLI

Source & flagged code

3 flagged

dist/chunk-GESPR7MT.jsView file

Lines 41-81javascript

41 exists: true,

42 type: match.type ?? null,

43 size: match.size ?? 0,

44 date: match.date ?? null,

45 url: match.url ?? null

46 };

47 }

48 return {

49 id: this.id,

50 name: this.name,

51 path: this.path,

52 exists: false,

53 type: null,

54 size: 0,

55 date: null,

56 url: null

57 };

58 }

59 async text() {

60 const bucket = await this.#bucket.info();

61 const url = bucket.base + "file/" + bucket.name + "/" + this.path;

62 const res = await this.#bucket.fetch(url);

63 return res.text();

64 }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-GESPR7MT.jsView on unpkg · L61

65 async json() {

66 const bucket = await this.#bucket.info();

67 const url = bucket.base + "file/" + bucket.name + "/" + this.path;

68 const res = await this.#bucket.fetch(url);

69 return res.json();

70 }

71 async arrayBuffer() {

72 const bucket = await this.#bucket.info();

73 const url = bucket.base + "file/" + bucket.name + "/" + this.path;

74 const res = await this.#bucket.fetch(url);

75 return res.arrayBuffer();

76 }

77 async blob() {

78 const bucket = await this.#bucket.info();

79 const url = bucket.base + "file/" + bucket.name + "/" + this.path;

80 const res = await this.#bucket.fetch(url);

81 return res.blob();

dist/chunk-MUR3Y2RD.jsView file

Lines 1-28javascript

1import {

2 cleanAndSignS3,

3 presignS3

4} from "./chunk-NMDZ3KLG.js";

5import {

6 parse_default,

7 promiseToReadable,

8 promiseToWritable,

9 sha256base64

10

dist/chunk-JVZSKCSS.jsView file

Lines 1-27javascript

1import {

2 importRsaPkcs8,

3 parse_default,

4 promiseToReadable,

5 promiseToWritable,

6 rsaSha256,

7 sha256hex,

8 toBase64Url,

9 toHex

10} from "./chunk-GUPCZAC5.js";

} from "./chunk-JLKDR735.js";

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

dist/chunk-MUR3Y2RD.jsView on unpkg · L8

11import {

12 getContentType,

13 joinPrefix,

14 scope,

15 withPrefix

16} from "./chunk-VQDKKNAD.js";

17

18// s3/File.ts

19import { Readable, Writable } from "stream";

20var S3File = class _S3File {

21 id;

22 name;

23 path;

24 #ctx;

25 constructor(path, ctx) {

26 this.path = path.startsWith("/") ? path.slice(1) : path;

27 this.name = this.path.split("/").pop() || this.path;

28 this.id = this.path;

11import {

12 getContentType

13} from "./chunk-UKJXR7F4.js";

14

15// lib/signGCS.ts

16var enc = new TextEncoder();

17var b64urlJson = (o) => toBase64Url(enc.encode(JSON.stringify(o)));

18var plainDate = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");

19async function getAccessToken(auth) {

20 const now = Math.floor(Date.now() / 1e3);

21 const header = b64urlJson({ alg: "RS256", typ: "JWT" });

22 const payload = b64urlJson({

23 iss: auth.clientEmail,

24 scope: "https://www.googleapis.com/auth/devstorage.read_write",

25 aud: "https://oauth2.googleapis.com/token",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-JVZSKCSS.jsView on unpkg · L7

26 exp: now + 3600,

27 iat: now