cdk-insights@1.61.6: Clean npm security report (Allow)

Loading npm security reports…

cdk-insights@1.61.6: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

12 flagged

2550${M.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(M.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${M.com... L2551: `))}}},Z=z1();var FC=e=>e&&(e.Name||e.ResourceName||e.FunctionName)||"Unnamed";var Lp=null,_C=e=>{Lp=e};var Op=()=>{if(Lp&&!process.env.CI)try{Lp.saveToDisk(),it.info("\u{1F4BE} Ca... L2552: `).map(t=>t.trim()).filter(Boolean).join(`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2550

2546${M.primary.bold("\u{1F381} CDK Insights Trial")}`),e.log(M.comment("\u2500".repeat(50))),e.log(`${je} Status: ${ke.bold(oe)}`),ae&&e.log(`\u{1F4E6} Plan: ${M.info.bold(ae.charAt(0... L2547: ${M.comment("\u{1F4A1} Next Steps:")}`),De?(e.log(M.error(" \u274C Trial expired - upgrade to continue")),e.log(M.comment(" \u{1F517} https://cdkinsights.dev/pricing"))):me>=90... L2548: `)},displayQuotaWarning:_=>{let{currentResourcesAnalyzed:B,maxResources:ne,requestedResources:ge,isTrial:De}=_;if(!De)return;B+ge>ne&&(e.log(` ... L2550: ${M.info("\u{1F4CB} Falling back to static analysis only")}`),e.log(M.comment("\u{1F4A1} Upgrade to Pro for unlimited AI analysis: https://cdkinsights.dev/pricing")),e.log(`${M.com... L2551: `))}}},Z=z1();var FC=e=>e&&(e.Name||e.ResourceName||e.FunctionName

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2546

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: `);let{statusCode:m,buffered:g}=yield p;if(m===200){if(t.once("socket",I0),s.secureEndpoint){oo("Upgrading socket connection to TLS");let h=s.servername||s.host;return wh.default.c... AWS_SECRET_ACCESS_KEY=your-secret`},CLOUDWATCH_MISSING_LOG_GROUP:{message:"CloudWatch transport requires logGroupName option",solution:"Provide logGroupName in transport options or... `,I=await fetch(E,{method:"POST",headers:{"Content-Type":"application/x-ndjson",...f()},body:R,signal:AbortSignal.timeout(d)});if(!I.ok){let L=await I.text().catch(()=>"Unable to r... `:"";return{status:"added",updated:`${JSON.stringify(i,null,2)}${o}`}},UB=e=>{let t=hm.join(e,"cd

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

1"use strict";var LI=Object.create;var da=Object.defineProperty;var OI=Object.getOwnPropertyDescriptor;var NI=Object.getOwnPropertyNames;var MI=Object.getPrototypeOf,BI=Object.proto... L2: `;Me.DEFAULT_CONTENT_TYPE="application/octet-stream";Me.prototype.append=function(e,t,s){s=s||{},typeof s=="string"&&(s={filename:s});var n=qu.prototype.append.bind(this);if((typeo...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L1

dist/entry.jsView file

1#!/usr/bin/env node L2: "use strict";var y1e=Object.create;var fw=Object.defineProperty;var S1e=Object.getOwnPropertyDescriptor;var b1e=Object.getOwnPropertyNames;var x1e=Object.getPrototypeOf,w1e=Object.... L3: `);let s;for(;(s=D1e.exec(r))!=null;){let n=s[1],o=s[2]||"";o=o.trim();let i=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),i==='"'&&(o=o.replace(/\\n/g,` L4: `),o=o.replace(/\\r/g,"\r")),t[n]=o}return t}function R1e(e){let t=L5(e),r=ns.configDotenv({path:t});if(!r.parsed){let i=new Error(`MISSING_DATA: Cannot parse ${t} for an unknown r... L5: `).forEach(function(i){n=i.indexOf(":"),r=i.substring(0,n).trim().toLowerCase(),s=i.substring(n+1).trim(),!(!r||t[r]&&DOe[r])&&(r==="set-cookie"?t[r]?t[r].push(s):t[r]=[s]:t[r]=t[r... L6: `)}getSetCookie(){return this.get("set-cookie")|

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/entry.jsView on unpkg · L1

1Trigger-reachable chain: manifest.bin -> dist/entry.js L1: #!/usr/bin/env node L2: "use strict";var y1e=Object.create;var fw=Object.defineProperty;var S1e=Object.getOwnPropertyDescriptor;var b1e=Object.getOwnPropertyNames;var x1e=Object.getPrototypeOf,w1e=Object.... L3: `);let s;for(;(s=D1e.exec(r))!=null;){let n=s[1],o=s[2]||"";o=o.trim();let i=o[0];o=o.replace(/^(['"`])([\s\S]*)\1$/mg,"$2"),i==='"'&&(o=o.replace(/\\n/g,` L4: `),o=o.replace(/\\r/g,"\r")),t[n]=o}return t}function R1e(e){let t=L5(e),r=ns.configDotenv({path:t});if(!r.parsed){let i=new Error(`MISSING_DATA: Cannot parse ${t} for an unknown r... L5: `).forEach(function(i){n=i.indexOf(":"),r=i.substring(0,n).trim().toLowerCase(),s=i.substring(n+1).trim(),!(!r||t[r]&&DOe[r])&&(r==="set-cookie"?t[r]?t[r].push(s):t[r]=[s]:t[r]=t[r.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/entry.jsView on unpkg · L1