construct-hub: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

construct-hub: Suspicious npm security report (Warn) | LPM Firewall

Oversized source lightweight scan

lib/backend/catalog-builder/catalog-builder.lambda.bundle/index.js2.60 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsa.cogithub.com

lib/backend/deny-list/prune-handler.lambda.bundle/index.js2.52 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/deny-list/prune-queue-handler.lambda.bundle/index.js2.42 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/ecs-task-monitor/monitor.lambda.bundle/index.js2.51 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/feed-builder/update-feed.lambda.bundle/index.js2.79 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.comths.be

lib/backend/ingestion/ingestion.lambda.bundle/index.js2.94 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsa.co

lib/backend/ingestion/re-ingest.lambda.bundle/index.js2.43 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsa.co

lib/backend/inventory/canary.lambda.bundle/index.js2.55 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.cogithub.com

lib/backend/inventory/package-versions-table-widget-function.lambda.bundle/index.js2.43 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsa.cogithub.coms3.console.aws.amazon.com

lib/backend/orchestration/needs-catalog-update.lambda.bundle/index.js2.43 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStringsUrlStringsa.cogithub.com

lib/backend/orchestration/read-uninstallable-report.lambda.bundle/index.js2.42 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/orchestration/redrive-state-machine.lambda.bundle/index.js2.43 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/package-stats/package-stats-aggregator.lambda.bundle/index.js2.51 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/package-stats/package-stats-chunker.lambda.bundle/index.js2.43 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/package-stats/package-stats-processor.lambda.bundle/index.js2.67 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.coapi.npmjs.org

lib/backend/release-notes/generate-release-notes.lambda.bundle/index.js3.32 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.cogithub.com

lib/backend/release-notes/get-messages-from-worker-queue.lambda.bundle/index.js3.03 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/release-notes/release-notes-trigger.lambda.bundle/index.js2.43 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.co

lib/backend/transliterator/transliterator.ecs-entrypoint.bundle/index.js14.0 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsHighEntropyStringsUrlStringsa.codocs.aws.amazon.comfeross.orggithub.commths.bewww.apache.org

lib/backend/transliterator/transliterator.ecs-entrypoint.bundle/translate_all_worker.js11.2 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsEvalCryptoShellHighEntropyStrings

Source & flagged code

7 flagged · loading source

website/static/js/487.c94daaad.chunk.jsView file

1/*! For license information please see 487.c94daaad.chunk.js.LICENSE.txt */ L2: (self.webpackChunkconstruct_hub_webapp=self.webpackChunkconstruct_hub_webapp||[]).push([[487],{80572(e,t,n){"use strict";n.d(t,{AD:()=>s});var r=n(21038),o=n(23216),i=n(65043),a=n(... L3: //# sourceMappingURL=487.c94daaad.chunk.js.map

High

Child Process

Package source references child process execution.

website/static/js/487.c94daaad.chunk.jsView on unpkg · L1

website/static/js/main.9e6b2567.jsView file

1/*! For license information please see main.9e6b2567.js.LICENSE.txt */ L2: (()=>{var e={11453(e,t,n){"use strict";n.d(t,{q:()=>r});let r=function(e){return e.NameAsc="asc",e.NameDesc="desc",e.PublishDateAsc="oldest",e.PublishDateDesc="newest",e.DownloadsA... L3: //# sourceMappingURL=main.9e6b2567.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

website/static/js/main.9e6b2567.jsView on unpkg · L1

lib/package-sources/npmjs/stage-and-notify.jsView file

4// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen". L5: const path = require("path"); L6: const lambda = require("aws-cdk-lib/aws-lambda");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/package-sources/npmjs/stage-and-notify.jsView on unpkg · L4

lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.jsView file

45if (version && !state.warningEmitted) { L46: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L47: state.warningEmitted = true; ... L60: L61: More information can be found at: https://a.co/c895JFp`); L62: } ... L704: init_isValidHostLabel(); L705: init_isValidHostname(); L706: init_normalizeProvider(); ... L868: if (reason?.$responseBodyText) { L869: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L870: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.jsView on unpkg · L45

45Cross-file remote execution chain: lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.js spawns lib/monitored-certificate/certificate-monitor.lambda.bundle/index.js; helper contains network access plus dynamic code execution. L45: if (version && !state.warningEmitted) { L46: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L47: state.warningEmitted = true; ... L60: L61: More information can be found at: https://a.co/c895JFp`); L62: } ... L704: init_isValidHostLabel(); L705: init_isValidHostname(); L706: init_normalizeProvider(); ... L868: if (reason?.$responseBodyText) { L869: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L870: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.js

lib/package-sources/npmjs/npm-js-follower.lambda.bundle/index.jsView file

•path = lib/package-sources/npmjs/npm[redacted]/index.js kind = oversized_source_file sizeBytes = 2699611 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/package-sources/npmjs/npm-js-follower.lambda.bundle/index.jsView on unpkg

lib/backend/transliterator/transliterator.ecs-entrypoint.bundle/index.jsView file

•path = [redacted].ecs-entrypoint.bundle/index.js kind = oversized_cli_entrypoint sizeBytes = 14672549 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

lib/backend/transliterator/transliterator.ecs-entrypoint.bundle/index.jsView on unpkg

Source & flagged code

7 flagged

website/static/js/487.c94daaad.chunk.jsView file

1/*! For license information please see 487.c94daaad.chunk.js.LICENSE.txt */ L2: (self.webpackChunkconstruct_hub_webapp=self.webpackChunkconstruct_hub_webapp||[]).push([[487],{80572(e,t,n){"use strict";n.d(t,{AD:()=>s});var r=n(21038),o=n(23216),i=n(65043),a=n(... L3: //# sourceMappingURL=487.c94daaad.chunk.js.map

High

Child Process

Package source references child process execution.

website/static/js/487.c94daaad.chunk.jsView on unpkg · L1

website/static/js/main.9e6b2567.jsView file

1/*! For license information please see main.9e6b2567.js.LICENSE.txt */ L2: (()=>{var e={11453(e,t,n){"use strict";n.d(t,{q:()=>r});let r=function(e){return e.NameAsc="asc",e.NameDesc="desc",e.PublishDateAsc="oldest",e.PublishDateDesc="newest",e.DownloadsA... L3: //# sourceMappingURL=main.9e6b2567.js.map

Low

Eval

Package source references a known benign dynamic code generation pattern.

website/static/js/main.9e6b2567.jsView on unpkg · L1

lib/package-sources/npmjs/stage-and-notify.jsView file

Lines 1-20javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.StageAndNotify = void 0;

4// ~~ Generated by projen. To modify, edit .projenrc.ts and run "npx projen".

5const path =

lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.jsView file

45if (version && !state.warningEmitted) { L46: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L47: state.warningEmitted = true; ... L60: L61: More information can be found at: https://a.co/c895JFp`); L62: } ... L704: init_isValidHostLabel(); L705: init_isValidHostname(); L706: init_normalizeProvider(); ... L868: if (reason?.$responseBodyText) { L869: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L870: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.jsView on unpkg · L45

45Cross-file remote execution chain: lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.js spawns lib/monitored-certificate/certificate-monitor.lambda.bundle/index.js; helper contains network access plus dynamic code execution. L45: if (version && !state.warningEmitted) { L46: if (process.env.AWS_SDK_JS_NODE_VERSION_SUPPORT_WARNING_DISABLED === "true") { L47: state.warningEmitted = true; ... L60: L61: More information can be found at: https://a.co/c895JFp`); L62: } ... L704: init_isValidHostLabel(); L705: init_isValidHostname(); L706: init_normalizeProvider(); ... L868: if (reason?.$responseBodyText) { L869: return `${status ? status + ": " : ""}Deserialization error for body: ${reason.$responseBodyText}`; L870: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/overview-dashboard/sqs-dlq-stats-widget-function.lambda.bundle/index.js

lib/package-sources/npmjs/npm-js-follower.lambda.bundle/index.jsView file

•path = lib/package-sources/npmjs/npm[redacted]/index.js kind = oversized_source_file sizeBytes = 2699611 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

lib/package-sources/npmjs/npm-js-follower.lambda.bundle/index.jsView on unpkg

lib/backend/transliterator/transliterator.ecs-entrypoint.bundle/index.jsView file

•path = [redacted].ecs-entrypoint.bundle/index.js kind = oversized_cli_entrypoint sizeBytes = 14672549 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

lib/backend/transliterator/transliterator.ecs-entrypoint.bundle/index.jsView on unpkg