codex-mobile-re@0.1.97: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

codex-mobile-re@0.1.97: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-native-build.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/assets/DirectoryHub-rK4pGPCJ.jsView file

2patternName = google_api_key severity = high line = 2 matchedText = import{d...lt};

High

High Secret

Package contains a high-severity secret pattern.

dist/assets/DirectoryHub-rK4pGPCJ.jsView on unpkg · L2

2patternName = google_api_key severity = high line = 2 matchedText = import{d...lt};

High

Secret Pattern

Google API key in dist/assets/DirectoryHub-rK4pGPCJ.js

dist/assets/DirectoryHub-rK4pGPCJ.jsView on unpkg · L2

dist/assets/common-BeuopZEI.jsView file

1function ur(r){return r&&r.__esModule&&Object.prototype.hasOwnProperty.call(r,"default")?r.default:r}var fn,lt;function gr(){if(lt)return fn;lt=1;function r(n){return n instanceof ... L2: https://github.com/highlightjs/highlight.js/issues/2277`),te=u,q=A),P===void 0&&(P=!0);const fe={code:q,language:te};Je("before:highlight",fe);const Re=fe.result?fe.result:ze(fe.la...

High

Child Process

Package source references child process execution.

dist/assets/common-BeuopZEI.jsView on unpkg · L1

dist-cli/index.jsView file

3Source sends the broad process environment to a literal external destination. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

50return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

High

Shell

Package source references shell execution.

dist-cli/index.jsView on unpkg · L50

3Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args

scripts/dev.cjsView file

1Cross-file remote execution chain: scripts/dev.cjs spawns dist-cli/index.js; helper contains network access plus dynamic code execution. L1: const { execFileSync, spawnSync } = require('node:child_process') L2: const { existsSync } = require('node:fs') ... L5: function isAndroidRuntime() { L6: if (process.platform === 'android') return true L7: if (process.env.TERMUX_VERSION) return true L8: if (process.env.PREFIX?.includes('/com.termux/')) return true ... L40: const passthroughArgs = process.argv.slice(2) L41: const viteBinPath = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'vite.cmd' : 'vite') L42: const vueTscBinPath = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'vue-tsc.cmd' : 'vue-tsc')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/dev.cjsView on unpkg · L1

Source & flagged code

16 flagged

package.jsonView file

Lines 58-84json

58 "@types/qrcode-terminal": "^0.12.2",

59 "@types/ws": "^8.18.1",

60 "@vitejs/plugin-vue": "^5.2.1",

61 "playwright": "^1.59.1",

62 "tailwindcss": "^4.1.18",

63 "tsup": "^8.4.0",

64 "typescript": "^5.7.3",

65 "vite": "^6.1.0",

66 "vitest": "^4.1.5",

67 "vue": "^3.5.13",

68 "vue-router": "^4.6.4",

69 "vue-tsc": "^2.2.0"

70 },

71 "scripts": {

72 "dev": "node scripts/dev.cjs",

73 "dev2": "node scripts/dev-random-home.cjs",

74 "dev:open": "pnpm run build:cli && sh -c 'pnpm run dev & VPID=$!; node dist-cli/index.js --open-project \"${1:-.}\"; wait $VPID' --",

75 "build:frontend": "vue-tsc --noEmit && vite build",

76 "build:cli": "tsup",

77 "build": "pnpm run build:frontend && pnpm run build:cli",

78 "postinstall": "node scripts/fix-pty-native-build.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L78

79 "test:unit": "vitest run",

80 "preview": "vite preview",

81 "profile:browser": "node scripts/profile-browser-runtime.cjs",

82 "profile:thread": "PROFILE_ROUTE='#/thread/019da7c0-4e12-7a91-837c-f7c11cc8ab6c' node scripts/profile-browser-runtime.cjs"

83 }

84}

dist/assets/DirectoryHub-rK4pGPCJ.jsView file

Lines 1-3javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/index.esm-Cxn_LBGD.js","assets/index.esm-Bx2Y2PLG.js","assets/index.esm-DYMAm9mq.js"])))=>i.map(i

dist/assets/common-BeuopZEI.jsView file

Lines 1-6javascript

1function ur(r){return r&&r.__esModule&&Object.prototype.hasOwnProperty.call(r,"default")?r.default:r}var fn,lt;function gr(){

dist-cli/index.jsView file

3Source sends the broad process environment to a literal external destination. L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist-cli/index.jsView on unpkg · L3

50return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args.map((arg) => quoteCmdExeArg(arg))].join(" ")]

High

Shell

Package source references shell execution.

dist-cli/index.jsView on unpkg · L50

3Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, sensitive-file+network, execution+network L3: // src/cli/index.ts L4: import { createServer as createServer2 } from "http"; L5: import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync8, mkdirSync as mkdirSync2 } from "fs"; ... L8: import { isAbsolute as isAbsolute4, join as join12, resolve as resolve3 } from "path"; L9: import { spawn as spawn5 } from "child_process"; L10: import { createInterface as createInterface2 } from "readline/promises"; ... L34: function needsCmdExeWrapper(command) { L35: if (process.platform !== "win32") { L36: return false; ... L50: return { L51: command: "cmd.exe", L52: args: ["/d", "/s", "/c", [quoteCmdExeArg(command), ...args

scripts/dev.cjsView file

1Cross-file remote execution chain: scripts/dev.cjs spawns dist-cli/index.js; helper contains network access plus dynamic code execution. L1: const { execFileSync, spawnSync } = require('node:child_process') L2: const { existsSync } = require('node:fs') ... L5: function isAndroidRuntime() { L6: if (process.platform === 'android') return true L7: if (process.env.TERMUX_VERSION) return true L8: if (process.env.PREFIX?.includes('/com.termux/')) return true ... L40: const passthroughArgs = process.argv.slice(2) L41: const viteBinPath = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'vite.cmd' : 'vite') L42: const vueTscBinPath = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? 'vue-tsc.cmd' : 'vue-tsc')

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/dev.cjsView on unpkg · L1