cdk-insights@1.61.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

cdk-insights@1.61.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/index.jsView file

2550${N.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(N.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${N.com... L2551: `))}}},Y=U1();var FC=e=>e&&(e.Name||e.ResourceName||e.FunctionName)||"Unnamed";var _p=null,_C=e=>{_p=e};var Lp=()=>{if(_p&&!process.env.CI)try{_p.saveToDisk(),it.info("\u{1F4BE} Ca... L2552: `).map(t=>t.trim()).filter(Boolean).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2550

2546${N.primary.bold("\u{1F381} CDK Insights Trial")}`),e.log(N.comment("\u2500".repeat(50))),e.log(`${je} Status: ${Ee.bold(oe)}`),ae&&e.log(`\u{1F4E6} Plan: ${N.info.bold(ae.charAt(0... L2547: ${N.comment("\u{1F4A1} Next Steps:")}`),Se?(e.log(N.error(" \u274C Trial expired - upgrade to continue")),e.log(N.comment(" \u{1F517} https://cdkinsights.dev/pricing"))):he>=90... L2548: `)},displayQuotaWarning:R=>{let{currentResourcesAnalyzed:M,maxResources:J,requestedResources:ge,isTrial:Se}=R;if(!Se)return;M+ge>J&&(e.log(` ... L2550: ${N.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(N.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${N.com... L2551: `))}}},Y=U1();var FC=e=>e&&(e.Name||e.ResourceName||e.FunctionName)|

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2546

1"use strict";var TI=Object.create;var da=Object.defineProperty;var PI=Object.getOwnPropertyDescriptor;var FI=Object.getOwnPropertyNames;var _I=Object.getPrototypeOf,LI=Object.proto... L2: `;Me.DEFAULT_CONTENT_TYPE="application/octet-stream";Me.prototype.append=function(e,t,s){s=s||{},typeof s=="string"&&(s={filename:s});var n=Hu.prototype.append.bind(this);if((typeo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/entry.jsView file

1#!/usr/bin/env node L2: "use strict";var EOe=Object.create;var Cw=Object.defineProperty;var AOe=Object.getOwnPropertyDescriptor;var COe=Object.getOwnPropertyNames;var DOe=Object.getPrototypeOf,IOe=Object.... L3: `);let s;for(;(s=POe.exec(r))!=null;){let n=s[1],o=s[2]||"";o=o.trim();let i=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),i==='"'&&(o=o.replace(/\\n/g,` L4: `),o=o.replace(/\\r/g,"\r")),e[n]=o}return e}function FOe(t){let e=oW(t),r=os.configDotenv({path:e});if(!r.parsed){let i=new Error(`MISSING_DATA: Cannot parse ${e} for an unknown r... L5: `).forEach(function(i){n=i.indexOf(":"),r=i.substring(0,n).trim().toLowerCase(),s=i.substring(n+1).trim(),!(!r||e[r]&&PFe[r])&&(r==="set-cookie"?e[r]?e[r].push(s):e[r]=[s]:e[r]=e[r... L6: `)}getSetCookie(){return this.get("set-cookie")|

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/entry.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/entry.js L1: #!/usr/bin/env node L2: "use strict";var EOe=Object.create;var Cw=Object.defineProperty;var AOe=Object.getOwnPropertyDescriptor;var COe=Object.getOwnPropertyNames;var DOe=Object.getPrototypeOf,IOe=Object.... L3: `);let s;for(;(s=POe.exec(r))!=null;){let n=s[1],o=s[2]||"";o=o.trim();let i=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),i==='"'&&(o=o.replace(/\\n/g,` L4: `),o=o.replace(/\\r/g,"\r")),e[n]=o}return e}function FOe(t){let e=oW(t),r=os.configDotenv({path:e});if(!r.parsed){let i=new Error(`MISSING_DATA: Cannot parse ${e} for an unknown r... L5: `).forEach(function(i){n=i.indexOf(":"),r=i.substring(0,n).trim().toLowerCase(),s=i.substring(n+1).trim(),!(!r||e[r]&&PFe[r])&&(r==="set-cookie"?e[r]?e[r].push(s):e[r]=[s]:e[r]=e[r.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/entry.jsView on unpkg · L1