cbs-4px-merchant-cli@0.0.8: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

cbs-4px-merchant-cli@0.0.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/services/completion-installer.jsView file

26Trigger-reachable persistence chain: manifest.main -> dist/index.js -> dist/cli.js -> dist/commands/skill.js -> dist/services/completion-installer.js L26: export function detectShell() { L27: const shellPath = process.env['SHELL']; L28: if (!shellPath) ... L35: function rcFileFor(home, shell) { L36: return join(home, shell === 'zsh' ? '.zshrc' : '.bashrc'); L37: } ... L61: } L62: const rcFile = rcFileFor(opts.home ?? homedir(), shell); L63: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/services/completion-installer.jsView on unpkg · L26

26export function detectShell() { L27: const shellPath = process.env['SHELL']; L28: if (!shellPath) ... L35: function rcFileFor(home, shell) { L36: return join(home, shell === 'zsh' ? '.zshrc' : '.bashrc'); L37: } ... L61: } L62: const rcFile = rcFileFor(opts.home ?? homedir(), shell); L63: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/services/completion-installer.jsView on unpkg · L26

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView file

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = high_entropy_blob sizeBytes = 18153 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = compressed_blob sizeBytes = 18153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = nested_archive_needs_inspection sizeBytes = 18153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

dist/services/update-checker.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.2 matchedPath = dist/services/update-checker.js matchedIdentity = npm:[redacted]:0.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/update-checker.jsView on unpkg

dist/commands/order.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cbs-4px-merchant-cli@0.0.6 matchedIdentity = npm:Y2JzLTRweC1tZXJjaGFudC1jbGk:0.0.6 similarity = 0.469 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/order.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 17-57json

17 ],

18 "scripts": {

19 "build": "node scripts/build.js",

20 "tsc": "tsc",

21 "dev": "tsx src/index.ts",

22 "typecheck": "tsc --noEmit",

23 "test": "node --import tsx --test test/*.test.ts",

24 "build:4px:test": "SITE=4px ENV=test npm run build",

25 "build:4px:pre": "SITE=4px ENV=pre npm run build",

26 "build:cainiao:test": "SITE=cainiao ENV=test npm run build",

27 "build:cainiao:pre": "SITE=cainiao ENV=pre npm run build",

28 "package:role-skills": "bash scripts/package-role-skills.sh",

29 "dev:4px:test": "SITE=4px ENV=test npm run build && node dist/index.js skill install",

30 "dev:4px:pre": "SITE=4px ENV=pre npm run build && node dist/index.js skill install",

31 "dev:cainiao:test": "SITE=cainiao ENV=test npm run build && node dist/index.js skill install",

32 "dev:cainiao:pre": "SITE=cainiao ENV=pre npm run build && node dist/index.js skill install",

33 "release": "npm run build && node scripts/publish.js",

34 "release:4px": "SITE=4px ENV=prod npm run release",

35 "release:cainiao": "SITE=cainiao ENV=prod npm run release",

36 "prepublishOnly": "node scripts/guard-publish.js",

37 "postinstall": "node scripts/postinstall.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L37

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L37

38 },

39 "publishConfig": {

40 "access": "public",

41 "registry": "https://registry.npmjs.org"

42 },

43 "dependencies": {

44 "axios": "^1.7.0",

45 "chalk": "^5.3.0",

46 "commander": "^12.0.0",

47 "ora": "^9.4.0"

48 },

49 "devDependencies": {

50 "@types/node": "^20.0.0",

51 "tsx": "^4.0.0",

52 "typescript": "^5.9.3"

53 },

54 "engines": {

55 "node": ">=18.0.0"

56 }

57}

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/services/completion-installer.jsView file

Lines 6-46javascript

6 * user's shell. Historically that last step was a manual copy-paste from

7 * `--help`, which is easy to skip — this module does it as part of

8 * `<bin> skill install`

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView file

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = high_entropy_blob sizeBytes = 18153 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = compressed_blob sizeBytes = 18153 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

•path = dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zip kind = nested_archive_needs_inspection sizeBytes = 18153 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/digital-employee-skills/cbs-4px-merchant-cli-order-fulfillment.zipView on unpkg

dist/services/update-checker.jsView file

•matchType = normalized_sha256 matchedPackage = cbs-cainiao-merchant-cli@0.0.2 matchedPath = dist/services/update-checker.js matchedIdentity = npm:[redacted]:0.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/update-checker.jsView on unpkg

dist/commands/order.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = cbs-4px-merchant-cli@0.0.6 matchedIdentity = npm:Y2JzLTRweC1tZXJjaGFudC1jbGk:0.0.6 similarity = 0.469 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/order.jsView on unpkg