cdk-insights@1.61.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

cdk-insights@1.61.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/index.jsView file

2550${M.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(M.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${M.com... L2551: `))}}},Z=z1();var FC=e=>e&&(e.Name||e.ResourceName||e.FunctionName)||"Unnamed";var Lp=null,_C=e=>{Lp=e};var Op=()=>{if(Lp&&!process.env.CI)try{Lp.saveToDisk(),it.info("\u{1F4BE} Ca... L2552: `).map(t=>t.trim()).filter(Boolean).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2550

2546${M.primary.bold("\u{1F381} CDK Insights Trial")}`),e.log(M.comment("\u2500".repeat(50))),e.log(`${je} Status: ${ke.bold(oe)}`),ae&&e.log(`\u{1F4E6} Plan: ${M.info.bold(ae.charAt(0... L2547: ${M.comment("\u{1F4A1} Next Steps:")}`),De?(e.log(M.error(" \u274C Trial expired - upgrade to continue")),e.log(M.comment(" \u{1F517} https://cdkinsights.dev/pricing"))):me>=90... L2548: `)},displayQuotaWarning:_=>{let{currentResourcesAnalyzed:B,maxResources:ne,requestedResources:ge,isTrial:De}=_;if(!De)return;B+ge>ne&&(e.log(` ... L2550: ${M.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(M.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${M.com... L2551: `))}}},Z=z1();var FC=e=>e&&(e.Name||e.ResourceName||e.FunctionName

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2546

1"use strict";var LI=Object.create;var da=Object.defineProperty;var OI=Object.getOwnPropertyDescriptor;var NI=Object.getOwnPropertyNames;var MI=Object.getPrototypeOf,BI=Object.proto... L2: `;Me.DEFAULT_CONTENT_TYPE="application/octet-stream";Me.prototype.append=function(e,t,s){s=s||{},typeof s=="string"&&(s={filename:s});var n=qu.prototype.append.bind(this);if((typeo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/entry.jsView file

1#!/usr/bin/env node L2: "use strict";var m1e=Object.create;var fw=Object.defineProperty;var h1e=Object.getOwnPropertyDescriptor;var g1e=Object.getOwnPropertyNames;var y1e=Object.getPrototypeOf,S1e=Object.... L3: `);let s;for(;(s=E1e.exec(r))!=null;){let n=s[1],o=s[2]||"";o=o.trim();let i=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),i==='"'&&(o=o.replace(/\\n/g,` L4: `),o=o.replace(/\\r/g,"\r")),t[n]=o}return t}function C1e(e){let t=L5(e),r=ns.configDotenv({path:t});if(!r.parsed){let i=new Error(`MISSING_DATA: Cannot parse ${t} for an unknown r... L5: `).forEach(function(i){n=i.indexOf(":"),r=i.substring(0,n).trim().toLowerCase(),s=i.substring(n+1).trim(),!(!r||t[r]&&EOe[r])&&(r==="set-cookie"?t[r]?t[r].push(s):t[r]=[s]:t[r]=t[r... L6: `)}getSetCookie(){return this.get("set-cookie")|

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/entry.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/entry.js L1: #!/usr/bin/env node L2: "use strict";var m1e=Object.create;var fw=Object.defineProperty;var h1e=Object.getOwnPropertyDescriptor;var g1e=Object.getOwnPropertyNames;var y1e=Object.getPrototypeOf,S1e=Object.... L3: `);let s;for(;(s=E1e.exec(r))!=null;){let n=s[1],o=s[2]||"";o=o.trim();let i=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),i==='"'&&(o=o.replace(/\\n/g,` L4: `),o=o.replace(/\\r/g,"\r")),t[n]=o}return t}function C1e(e){let t=L5(e),r=ns.configDotenv({path:t});if(!r.parsed){let i=new Error(`MISSING_DATA: Cannot parse ${t} for an unknown r... L5: `).forEach(function(i){n=i.indexOf(":"),r=i.substring(0,n).trim().toLowerCase(),s=i.substring(n+1).trim(),!(!r||t[r]&&EOe[r])&&(r==="set-cookie"?t[r]?t[r].push(s):t[r]=[s]:t[r]=t[r.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/entry.jsView on unpkg · L1