chai-as-mno@1.0.5: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

chai-as-mno@1.0.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

lib/config.jsView file

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: (function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

High

Child Process

Package source references child process execution.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0x37a0,C:0x28de,n:0x1f9f,P:0x4fd,x:0x3c90,A:0x4a1d,k:0x2bf,l:0x258a,c:0x1f15,Q:0x1cd7,L:0x3c21,g:0x11ff,I:0x4f08,D:0x3ac3,w:0x7213,X:0x53f6,b:'\x47\x35\x77\x77',f:0x5bc3,U:0x4289,O:0x32ae,Ty:0x82df,Td:0x73c9,Tj:0x2575,TT:0x3f88,TF:0x20b7,TS:0x958,

High

Ai Review Evidence

lib/config.js is a 4.08 MB single-line obfuscated program with runtime string-decoding logic.

lib/config.jsView on unpkg · L1

lib/tools.jsView file

•matchType = malicious_source_fingerprint_signature signature = 714e8be58f5b346d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chai-as-soul@2.3.6 matchedPath = lib/tools.js matchedIdentity = npm:Y2hhaS1hcy1zb3Vs:2.3.6 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/tools.jsView on unpkg

Source & flagged code

6 flagged

lib/config.jsView file

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: (function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

High

Child Process

Package source references child process execution.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0x37a0,C:0x28de,n:0x1f9f,P:0x4fd,x:0x3c90,A:0x4a1d,k:0x2bf,l:0x258a,c:0x1f15,Q:0x1cd7,L:0x3c21,g:0x11ff,I:0x4f08,D:0x3ac3,w:0x7213,X:0x53f6,b:'\x47\x35\x77\x77',f:0x5bc3,U:0x4289,O:0x32ae,Ty:0x82df,Td:0x73c9,Tj:0x2575,TT:0x3f88,TF:0x20b7,TS:0x958,

High

Ai Review Evidence

lib/config.js is a 4.08 MB single-line obfuscated program with runtime string-decoding logic.

lib/config.jsView on unpkg · L1

lib/tools.jsView file

•matchType = malicious_source_fingerprint_signature signature = 714e8be58f5b346d signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = chai-as-soul@2.3.6 matchedPath = lib/tools.js matchedIdentity = npm:Y2hhaS1hcy1zb3Vs:2.3.6 similarity = 1.000 shingleOverlap = 12 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/tools.jsView on unpkg