coze-coding-dev-sdk@0.7.28: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

coze-coding-dev-sdk@0.7.28: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/esm/131.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = coze-coding-dev-sdk@0.7.25 matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.25 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/131.mjsView on unpkg

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){...

High

Child Process

Package source references child process execution.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){... L3: CREATE TABLE IF NOT EXISTS ${sql_sql.identifier(a)}.${sql_sql.identifier(t)} ( ... L68: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html L69: or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler config.`),Date.now()}return n}constructor(e){this.configProvider=new Promise((n,i)=>{"function"==typeof ... L70: `),l.push(e),l.push("\r\n")}),e.on(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/131.mjsView on unpkg · L1

dist/cjs/index.jsView file

11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cjs/index.js L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,i)=>e.PartNumber-i.PartNumber);let r={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};e=await this.clien... L13: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L22: ${i} L23: ${(0,r.n)(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let i=[];for(let t of e.split("/"))t?.length!==0&&"."!==t&&(".."===t?i.pop():i.push(t));let t=`${e?.startsWith("/")... L24: import os

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cjs/index.jsView on unpkg · L11

44}); L45: `;try{let e;g.writeFileSync(l,d),t&&console.log("Introspecting database schema...");let n=`npx drizzle-kit introspect --config=${l}`;t&&console.log(`Running: ${n}`);try{e=(0,o.exec... L46: ${e||i||t.message}`)}if(e&&(e.includes("error:")||e.includes("Error:")))throw Error(`drizzle-kit introspect failed:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.jsView on unpkg · L44

Source & flagged code

7 flagged

dist/esm/131.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = coze-coding-dev-sdk@0.7.25 matchedIdentity = npm:Y296ZS1jb2RpbmctZGV2LXNkaw:0.7.25 similarity = 0.927 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/esm/131.mjsView on unpkg

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){...

High

Child Process

Package source references child process execution.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/esm/131.mjsView on unpkg · L1

1let e,n,i,t,a,r,o,u,s,l,h,c,g,d,p,f;import*as m from"buffer";import*as y from"crypto";import*as S from"events";import*as b from"fs";import*as C from"node:fs";import*as w from"node:... L2: params: ${n}`),this.query=e,this.params=n,this.cause=i,Error.captureStackTrace(this,ia),i&&(this.cause=i)}}class ir extends it{static [nd]="TransactionRollbackError";constructor(){... L3: CREATE TABLE IF NOT EXISTS ${sql_sql.identifier(a)}.${sql_sql.identifier(t)} ( ... L68: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html L69: or increase socketAcquisitionWarningTimeout=(millis) in the NodeHttpHandler config.`),Date.now()}return n}constructor(e){this.configProvider=new Promise((n,i)=>{"function"==typeof ... L70: `),l.push(e),l.push("\r\n")}),e.on(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/esm/131.mjsView on unpkg · L1

dist/cjs/index.jsView file

11Trigger-reachable command-output exfiltration chain: manifest.main -> dist/cjs/index.js L11: to input.params.ContentLength in bytes. L12: `);this.uploadedParts.sort((e,i)=>e.PartNumber-i.PartNumber);let r={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};e=await this.clien... L13: See https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/node-configuring-maxsockets.html ... L22: ${i} L23: ${(0,r.n)(s)}`}getCanonicalPath({path:e}){if(this.uriEscapePath){let i=[];for(let t of e.split("/"))t?.length!==0&&"."!==t&&(".."===t?i.pop():i.push(t));let t=`${e?.startsWith("/")... L24: import os

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cjs/index.jsView on unpkg · L11

44}); L45: `;try{let e;g.writeFileSync(l,d),t&&console.log("Introspecting database schema...");let n=`npx drizzle-kit introspect --config=${l}`;t&&console.log(`Running: ${n}`);try{e=(0,o.exec... L46: ${e||i||t.message}`)}if(e&&(e.includes("error:")||e.includes("Error:")))throw Error(`drizzle-kit introspect failed:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cjs/index.jsView on unpkg · L44