cortana-md-engine@1.4.3: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

cortana-md-engine@1.4.3: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/hosted.cjsView file

1467patternName = google_api_key severity = high line = 1467

High

High Secret

Package contains a high-severity secret pattern.

dist/hosted.cjsView on unpkg · L1467

1150\u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L1151: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await TD();if(!i)return t("\u274C Failed to authenticate wi... L1152:

High

Child Process

Package source references child process execution.

dist/hosted.cjsView on unpkg · L1150

1144L1145: > Downloaded via Cortana MD Premium`,contextInfo:{externalAdReply:{title:u.title||c,body:"CORTANA MD | VIDEO DOWNLOADER",thumbnailUrl:u.thumbnail,mediaType:2,showAdAttribution:!1,s... L1146: ... L1150: \u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L1151: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await TD();if(!i)return t("\u274C Failed to authenticate wi... L1152:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hosted.cjsView on unpkg · L1144

1467patternName = google_api_key severity = high line = 1467

High

Secret Pattern

Google API key in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L1467

6) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(a);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);xa.write(lx.format.apply(lx,e))}}Object.defineProperty(nr.exports,"isWin",{get:function(){return Ac},set:function(t){Ac=t}});nr.exports.warnTo=function(t){var e=xa;return xa=t,e...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted.cjsView on unpkg · L6

1088patternName = generic_password severity = medium line = 1088

Medium

Secret Pattern

Hardcoded password in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L1088

1"use strict";var tM=Object.create;var To=Object.defineProperty;var nM=Object.getOwnPropertyDescriptor;var rM=Object.getOwnPropertyNames;var sM=Object.getPrototypeOf,iM=Object.proto... L2: CREATE TABLE IF NOT EXISTS ${T.identifier(i)}.${T.identifier(s)} ( ... L6: ) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(a);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);xa.write(lx.format.apply(lx,e))}}Object.defineProperty(nr.exports,"isWin",{get:function(){return Ac},set:function(t){Ac=t}});nr.exports.warnTo=function(t){var e=xa;return xa=t,e... L9: <div class="wall-scrim"></div> ... L375: if (legacyCopy(text)) return Promise.resolve(true); L376: if (navigator.clipboard && navigator.clipboard.write

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hosted.cjsView on unpkg · L1

dist/index.cjsView file

1"use strict";var KD=Object.create;var Ru=Object.defineProperty;var QD=Object.getOwnPropertyDescriptor;var YD=Object.getOwnPropertyNames;var XD=Object.getPrototypeOf,ZD=Object.proto... L2: at `+t[n].toString();return e}function i5(t){if(!t)throw new TypeError("argument namespace is required");var e=Nu(),n=fs(e[1]),r=n[0];function a(i){Pu.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function fs(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+Bm(e)),a}function u5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";retu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L1

4at `+n[i].toString();return a}return e&&(a+=" at "+Bm(e)),a}function u5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";return r}return e&&(r+=" \x1B[36m"+Bm(e)+"\x1B[39m"),r}function Bm(t){return e5(t5,t[0])+":"+t[1]+":"+t[2]}function Nu(){var t=Error.stackTr... L6: return function (`+n+`) {log.call(deprecate, message, site)

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L4

1"use strict";var KD=Object.create;var Ru=Object.defineProperty;var QD=Object.getOwnPropertyDescriptor;var YD=Object.getOwnPropertyNames;var XD=Object.getPrototypeOf,ZD=Object.proto... L2: at `+t[n].toString();return e}function i5(t){if(!t)throw new TypeError("argument namespace is required");var e=Nu(),n=fs(e[1]),r=n[0];function a(i){Pu.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function fs(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+Bm(e)),a}function u5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";retu

Source & flagged code

12 flagged

dist/hosted.cjsView file

1467patternName = google_api_key severity = high line = 1467

High

High Secret

Package contains a high-severity secret pattern.

dist/hosted.cjsView on unpkg · L1467

1150\u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L1151: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await TD();if(!i)return t("\u274C Failed to authenticate wi... L1152:

High

Child Process

Package source references child process execution.

dist/hosted.cjsView on unpkg · L1150

1144L1145: > Downloaded via Cortana MD Premium`,contextInfo:{externalAdReply:{title:u.title||c,body:"CORTANA MD | VIDEO DOWNLOADER",thumbnailUrl:u.thumbnail,mediaType:2,showAdAttribution:!1,s... L1146: ... L1150: \u{1F4DE} *+254113374182*`);if(e.length<2)return t(`\u274C Usage: .mpesa <phone> <amount> L1151: Example: .mpesa 254712345678 1`);let r=e[0],s=e[1];await t(`\u{1F4B8} Initiating STK Push of KES ${s} to ${r}...`);let i=await TD();if(!i)return t("\u274C Failed to authenticate wi... L1152:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hosted.cjsView on unpkg · L1144

1467patternName = google_api_key severity = high line = 1467

High

Secret Pattern

Google API key in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L1467

6) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(a);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);xa.write(lx.format.apply(lx,e))}}Object.defineProperty(nr.exports,"isWin",{get:function(){return Ac},set:function(t){Ac=t}});nr.exports.warnTo=function(t){var e=xa;return xa=t,e...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/hosted.cjsView on unpkg · L6

1088patternName = generic_password severity = medium line = 1088

Medium

Secret Pattern

Hardcoded password in dist/hosted.cjs

dist/hosted.cjsView on unpkg · L1088

1"use strict";var tM=Object.create;var To=Object.defineProperty;var nM=Object.getOwnPropertyDescriptor;var rM=Object.getOwnPropertyNames;var sM=Object.getPrototypeOf,iM=Object.proto... L2: CREATE TABLE IF NOT EXISTS ${T.identifier(i)}.${T.identifier(s)} ( ... L6: ) L7: `;await n.execute(T`CREATE SCHEMA IF NOT EXISTS ${T.identifier(i)}`),await n.execute(a);let c=(await n.all(T`select id, hash, created_at from ${T.identifier(i)}.${T.identifier(s)} ... L8: `);xa.write(lx.format.apply(lx,e))}}Object.defineProperty(nr.exports,"isWin",{get:function(){return Ac},set:function(t){Ac=t}});nr.exports.warnTo=function(t){var e=xa;return xa=t,e... L9: <div class="wall-scrim"></div> ... L375: if (legacyCopy(text)) return Promise.resolve(true); L376: if (navigator.clipboard && navigator.clipboard.write

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/hosted.cjsView on unpkg · L1

dist/index.cjsView file

1"use strict";var KD=Object.create;var Ru=Object.defineProperty;var QD=Object.getOwnPropertyDescriptor;var YD=Object.getOwnPropertyNames;var XD=Object.getPrototypeOf,ZD=Object.proto... L2: at `+t[n].toString();return e}function i5(t){if(!t)throw new TypeError("argument namespace is required");var e=Nu(),n=fs(e[1]),r=n[0];function a(i){Pu.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function fs(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+Bm(e)),a}function u5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";retu

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.cjsView on unpkg · L1

4at `+n[i].toString();return a}return e&&(a+=" at "+Bm(e)),a}function u5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";return r}return e&&(r+=" \x1B[36m"+Bm(e)+"\x1B[39m"),r}function Bm(t){return e5(t5,t[0])+":"+t[1]+":"+t[2]}function Nu(){var t=Error.stackTr... L6: return function (`+n+`) {log.call(deprecate, message, site)

High

Eval

Package source references dynamic code evaluation.

dist/index.cjsView on unpkg · L4

1"use strict";var KD=Object.create;var Ru=Object.defineProperty;var QD=Object.getOwnPropertyDescriptor;var YD=Object.getOwnPropertyNames;var XD=Object.getPrototypeOf,ZD=Object.proto... L2: at `+t[n].toString();return e}function i5(t){if(!t)throw new TypeError("argument namespace is required");var e=Nu(),n=fs(e[1]),r=n[0];function a(i){Pu.call(a,i)}return a._file=r,a.... L3: `,"utf8")}}}function fs(t){var e=t.getFileName()||"<anonymous>",n=t.getLineNumber(),r=t.getColumnNumber();t.isEval()&&(e=t.getEvalOrigin()+", "+e);var a=[e,n,r];return a.callSite=t... L4: at `+n[i].toString();return a}return e&&(a+=" at "+Bm(e)),a}function u5(t,e,n){var r="\x1B[36;1m"+this._namespace+"\x1B[22;39m \x1B[33;1mdeprecated\x1B[22;39m \x1B[0m"+t+"\x1B[39m"... L5: \x1B[36mat `+n[a].toString()+"\x1B[39m";retu