coze-coding-dev-sdk: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

coze-coding-dev-sdk: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/esm/131.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = coze-coding-dev-sdk@0.7.30 matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.30 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/131.mjsView on unpkg

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){...

High

Child Process

Package source references child process execution.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){... L3: CREATE TABLE IF NOT EXISTS ${sql_sql.identifier(a)}.${sql_sql.identifier(t)} ( ... L19: print(f"# Error: {e}", file=sys.stderr) L20: `;for(let n of X(`python3 -c '${e.replace(/'/g,"'\"'\"'")}'`,{encoding:"utf-8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim().split("\n")){if(n.startsWith("#"))continue;let e=n.... L21: export default { ... L64: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/no

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/131.mjsView on unpkg · L1

dist/cjs/index.jsView file

11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cjs/index.js L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,i)=>e.PartNumber-i.PartNumber);let r={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};e=await this.clien... L13: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L22: ${i} L23: ${(0,r.n)(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let i=[];for(let t of e.split("/"))t?.length!==0&&"."!==t&&(".."===t?i.pop():i.push(t));let t=`${e?.startsWith("/")... L24: import os

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cjs/index.jsView on unpkg · L11

34print(f"# Error: {e}", file=sys.stderr) L35: `;for(let i of(0,o.execSync)(`python3 -c '${e.replace(/'/g,"'\"'\"'")}'`,{encoding:"utf-8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim().split("\n")){if(i.startsWith("#"))conti... L36: export default {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.jsView on unpkg · L34

dist/cjs/0~634.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~634.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~634.jsView on unpkg

dist/cjs/0~864.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~864.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~864.jsView on unpkg

dist/esm/cli/index.mjsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/esm/cli/index.mjs matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/esm/cli/index.mjsView on unpkg

dist/cjs/0~329.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~329.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~329.jsView on unpkg

dist/cjs/0~710.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~710.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~710.jsView on unpkg

Source & flagged code

12 flagged

dist/esm/131.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = coze-coding-dev-sdk@0.7.30 matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.30 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/131.mjsView on unpkg

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){...

High

Child Process

Package source references child process execution.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,iu),i&&(this.cause=i)}}class is extends io{static [nm]="TransactionRollbackError";constructor(){... L3: CREATE TABLE IF NOT EXISTS ${sql_sql.identifier(a)}.${sql_sql.identifier(t)} ( ... L19: print(f"# Error: {e}", file=sys.stderr) L20: `;for(let n of X(`python3 -c '${e.replace(/'/g,"'\"'\"'")}'`,{encoding:"utf-8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim().split("\n")){if(n.startsWith("#"))continue;let e=n.... L21: export default { ... L64: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/no

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/131.mjsView on unpkg · L1

dist/cjs/index.jsView file

11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cjs/index.js L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,i)=>e.PartNumber-i.PartNumber);let r={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};e=await this.clien... L13: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L22: ${i} L23: ${(0,r.n)(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let i=[];for(let t of e.split("/"))t?.length!==0&&"."!==t&&(".."===t?i.pop():i.push(t));let t=`${e?.startsWith("/")... L24: import os

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cjs/index.jsView on unpkg · L11

34print(f"# Error: {e}", file=sys.stderr) L35: `;for(let i of(0,o.execSync)(`python3 -c '${e.replace(/'/g,"'\"'\"'")}'`,{encoding:"utf-8",timeout:1e4,stdio:["pipe","pipe","pipe"]}).trim().split("\n")){if(i.startsWith("#"))conti... L36: export default {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.jsView on unpkg · L34

dist/cjs/0~634.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~634.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~634.jsView on unpkg

dist/cjs/0~864.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~864.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~864.jsView on unpkg

dist/esm/cli/index.mjsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/esm/cli/index.mjs matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/esm/cli/index.mjsView on unpkg

dist/cjs/0~329.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~329.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~329.jsView on unpkg

dist/cjs/0~710.jsView file

•matchType = normalized_sha256 matchedPackage = coze-coding-dev-sdk@0.7.29 matchedPath = dist/cjs/0~710.js matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cjs/0~710.jsView on unpkg