chai-as-fusion@2.3.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

chai-as-fusion@2.3.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

5const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants'); const config = require('./lib/config'); const { pid } = pr

High

Ai Review Evidence

Importing the main entrypoint loads lib/config.js.

index.jsView on unpkg · L5

lib/config.jsView file

1function K(){const aq=['\x57\x52\x64\x63\x53\x6d\x6b\x59\x57\x37\x37\x63\x50\x61','\x57\x52\x56\x63\x50\x6d\x6b\x51\x57\x50\x68\x63\x4d\x47','\x57\x34\x37\x63\x4f\x53\x6f\x30\x57\x...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function K(){const aq=['\x57\x52\x64\x63\x53\x6d\x6b\x59\x57\x37\x37\x63\x50\x61','\x57\x52\x56\x63\x50\x6d\x6b\x51\x57\x50\x68\x63\x4d\x47','\x57\x34\x37\x63\x4f\x53\x6f\x30\x57\x...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

•path = lib/config.js kind = oversized_source_file sizeBytes = 4498414 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/config.jsView on unpkg

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [ "fast", "logger",

High

Ai Review Evidence

The package declares index.js as its main entrypoint.

package.jsonView on unpkg · L5

Source & flagged code

7 flagged

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

5const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants'); const config = require('./lib/config'); const { pid } = pr

High

Ai Review Evidence

Importing the main entrypoint loads lib/config.js.

index.jsView on unpkg · L5

lib/config.jsView file

1function K(){const aq=['\x57\x52\x64\x63\x53\x6d\x6b\x59\x57\x37\x37\x63\x50\x61','\x57\x52\x56\x63\x50\x6d\x6b\x51\x57\x50\x68\x63\x4d\x47','\x57\x34\x37\x63\x4f\x53\x6f\x30\x57\x...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function K(){const aq=['\x57\x52\x64\x63\x53\x6d\x6b\x59\x57\x37\x37\x63\x50\x61','\x57\x52\x56\x63\x50\x6d\x6b\x51\x57\x50\x68\x63\x4d\x47','\x57\x34\x37\x63\x4f\x53\x6f\x30\x57\x...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

•path = lib/config.js kind = oversized_source_file sizeBytes = 4498414 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

lib/config.jsView on unpkg

package.jsonView file

5"main": "index.js", "scripts": { "smoke:pino": "node ./index.js", "smoke:file": "node ./file.js" }, "keywords": [ "fast", "logger",

High

Ai Review Evidence

The package declares index.js as its main entrypoint.

package.jsonView on unpkg · L5