burnboard-cli@0.3.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

burnboard-cli@0.3.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged · loading source

cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = burnboard-cli@0.3.2 matchedIdentity = npm:YnVybmJvYXJkLWNsaQ:0.3.2 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.mjsView on unpkg

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url"; ... L9: const installRoot = path.join(packageRoot, "install"); L10: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L11: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L12: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L24: if (result.error) throw result.error; L25: process.exitCode = result.status ?? 1; L26: return result.status ?? 1; ... L34: if (fs.existsSync(existingConfigPath)) try { savedServer = JSON.parse(fs.readFileSync(existingConfigPath, "utf8").replace(/^\uFEFF/, "")).serverUrl; } catch {} L35: const server = requestedServer || serverOverride || (mode

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

cli.mjsView on unpkg · L4

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli.mjs: const server = requestedServer || serverOverride || (mode !== "connect" ? savedServer : undefined) || "https://burnboard.cc"; fs.writeFileSync(installedVersionPath, `${cliVersion}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`); const server = option("--server", "https://burnboard.cc"); fs.writeFileSync(path.join(burnboardRoot, "config.json"), `${JSON.stringify({ serverUrl:server, token:body.token, profileUrl:body.profileUrl }, null, 2)}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli.mjsView on unpkg

4import path from "node:path"; L5: import { spawnSync } from "node:child_process"; L6: import { fileURLToPath } from "node:url"; ... L9: const installRoot = path.join(packageRoot, "install"); L10: const burnboardRoot = path.join(os.homedir(), ".burnboard"); L11: const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version; L12: const installedVersionPath = path.join(burnboardRoot, "cli-version"); ... L24: if (result.error) throw result.error; L25: process.exitCode = result.status ?? 1; L26: return result.status ?? 1; ... L34: if (fs.existsSync(existingConfigPath)) try { savedServer = JSON.parse(fs.readFileSync(existingConfigPath, "utf8").replace(/^\uFEFF/, "")).serverUrl; } catch {} L35: const server = requestedServer || serverOverride || (mode

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

install/burnboard-setup.shView file

•path = install/burnboard-setup.sh kind = build_helper sizeBytes = 6425 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-setup.shView on unpkg

Source & flagged code

5 flagged

cli.mjsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import fs from "node:fs";

3import os from "node:os";

4import path from "node:path";

5import { spawnSync } from "node:child_process";

6import { fileURLToPath } from "node:url";

7

8const packageRoot = path.dirname(fileURLToPath(import.meta.url));

9const installRoot = path.join(packageRoot, "install");

10const burnboardRoot = path.join(os.homedir(), ".burnboard");

11const cliVersion = JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8")).version;

12const installedVersionPath = path.join(burnboardRoot, "cli-version");

13const lastUpdateCheckPath = path.join(burnboardRoot, "last-update-check");

14const command = process.argv[2] || "help";

15const args = process.argv.slice(3);

16

17function option(name, fallback) {

18 const index = args.indexOf(name);

19 return index >= 0 ? args[index + 1] : fallback;

20}

21

22function run(executable, runArgs) {

23 const result = spawnSync(executable, runArgs, { stdio: "inherit" });

24 if (result.error) throw result.error;

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

cli.mjsView on unpkg · L4

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L4

•matchType = previous_version_dangerous_delta matchedPackage = burnboard-cli@0.3.2 matchedIdentity = npm:YnVybmJvYXJkLWNsaQ:0.3.2 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.mjsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. cli.mjs: const server = requestedServer || serverOverride || (mode !== "connect" ? savedServer : undefined) || "https://burnboard.cc"; fs.writeFileSync(installedVersionPath, `${cliVersion}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`); const server = option("--server", "https://burnboard.cc"); fs.writeFileSync(path.join(burnboardRoot, "config.json"), `${JSON.stringify({ serverUrl:server, token:body.token, profileUrl:body.profileUrl }, null, 2)}\n`); fs.writeFileSync(lastUpdateCheckPath, `${new Date().toISOString()}\n`);

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

cli.mjsView on unpkg

install/burnboard-setup.shView file

•path = install/burnboard-setup.sh kind = build_helper sizeBytes = 6425 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install/burnboard-setup.shView on unpkg