codex-mobile-re@0.1.127: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

codex-mobile-re@0.1.127: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/assets/DirectoryHub-ky-MNTyn.jsView file

2patternName = google_api_key severity = high line = 2

High

High Secret

Package contains a high-severity secret pattern.

dist/assets/DirectoryHub-ky-MNTyn.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2

High

Secret Pattern

Google API key in dist/assets/DirectoryHub-ky-MNTyn.js

dist/assets/DirectoryHub-ky-MNTyn.jsView on unpkg · L2

scripts/dev-random-home.cjsView file

3const { join } = require('node:path') L4: const { spawnSync } = require('node:child_process') L5:

High

Child Process

Package source references child process execution.

scripts/dev-random-home.cjsView on unpkg · L3

dist-cli/index.jsView file

3Source sends the broad process environment to a literal external destination. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync, createWriteStream, existsSync as existsSync14, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute13, join as join31, resolve as resolve8 } from "path"; L9: import { spawn as spawn9 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

3Trigger-reachable chain: manifest.bin -> dist-cli/index.js L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync, createWriteStream, existsSync as existsSync14, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute13, join as join31, resolve as resolve8 } from "path"; L9: import { spawn as spawn9 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-cli/index.jsView on unpkg · L3

Source & flagged code

11 flagged

dist/assets/DirectoryHub-ky-MNTyn.jsView file

Lines 1-3javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index.esm-Cls06s1L.js","assets/index.esm-Bx2Y2PLG.js","assets/index.esm-DYMAm9mq.js"])))=>i.map(i=>d[i]);

2import{e as be,f as l,i as o,j as s,F as T,l as B,n as Y,t as i,k as u,O as ta,u as n,w as xe,p as Oe,a1 as sa,v as lt,c as S,_ as ot,x

3

Long lines were clipped for display.

scripts/dev-random-home.cjsView file

Lines 1-22javascript

1const { mkdtempSync } = require('node:fs')

2const { tmpdir } = require('node:os')

3const { join } =

dist-cli/index.jsView file

3Source sends the broad process environment to a literal external destination. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync, createWriteStream, existsSync as existsSync14, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute13, join as join31, resolve as resolve8 } from "path"; L9: import { spawn as spawn9 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

3Trigger-reachable chain: manifest.bin -> dist-cli/index.js L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync, createWriteStream, existsSync as existsSync14, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute13, join as join31, resolve as resolve8 } from "path"; L9: import { spawn as spawn9 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist-cli/index.jsView on unpkg · L3