create-cedar-app@6.0.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

create-cedar-app@6.0.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged · loading source

dist/create-cedar-app.jsView file

4Source sends the broad process environment to a literal external destination. L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/create-cedar-app.jsView on unpkg · L4

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p...

High

Child Process

Package source references child process execution.

dist/create-cedar-app.jsView on unpkg · L6

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p...

High

Shell

Package source references shell execution.

dist/create-cedar-app.jsView on unpkg · L6

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of c.entries()){if(o+=l,Dp.has(l)){let{groups:f}=new RegExp(`(?:\\${NR}(?<code>\\d+)m|\\${eS}(?<uri>.*)${Zm})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/create-cedar-app.jsView on unpkg · L6

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/create-cedar-app.js: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... `,a=this.shim.path.basename(e);return e.match(/\.js$/)&&(e=`./${e}`),o=o.replace(/{{ap

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/create-cedar-app.jsView on unpkg

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of c.entries()){if(o+=l,Dp.has(l)){let{groups:f}=new RegExp(`(?:\\${NR}(?<code>\\d+)m|\\${eS}(?<uri>.*)${Zm})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/create-cedar-app.jsView on unpkg · L6

4const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/create-cedar-app.jsView on unpkg · L4

6Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/create-cedar-app.js L6: L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of c.entries()){if(o+=l,Dp.has(l)){let{groups:f}=new RegExp(`(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/create-cedar-app.jsView on unpkg · L6

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/create-cedar-app.jsView on unpkg

2L3: const require = (await import("node:module")).createRequire(import.meta.url); L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/create-cedar-app.jsView on unpkg · L2

Source & flagged code

10 flagged

dist/create-cedar-app.jsView file

4Source sends the broad process environment to a literal external destination. L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/create-cedar-app.jsView on unpkg · L4

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p...

High

Child Process

Package source references child process execution.

dist/create-cedar-app.jsView on unpkg · L6

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p...

High

Shell

Package source references shell execution.

dist/create-cedar-app.jsView on unpkg · L6

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of c.entries()){if(o+=l,Dp.has(l)){let{groups:f}=new RegExp(`(?:\\${NR}(?<code>\\d+)m|\\${eS}(?<uri>.*)${Zm})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/create-cedar-app.jsView on unpkg · L6

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/create-cedar-app.js: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... `,a=this.shim.path.basename(e);return e.match(/\.js$/)&&(e=`./${e}`),o=o.replace(/{{ap

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/create-cedar-app.jsView on unpkg

6L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of c.entries()){if(o+=l,Dp.has(l)){let{groups:f}=new RegExp(`(?:\\${NR}(?<code>\\d+)m|\\${eS}(?<uri>.*)${Zm})`).exec(c.slice(u).join(""))||{groups:{}};if(f.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/create-cedar-app.jsView on unpkg · L6

4const __filename = (await import("node:url")).fileURLToPath(import.meta.url); L5: const __dirname = (await import("node:path")).dirname(__filename); L6: L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/create-cedar-app.jsView on unpkg · L4

6Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/create-cedar-app.js L6: L7: var oee=Object.create;var Vl=Object.defineProperty;var see=Object.getOwnPropertyDescriptor;var aee=Object.getOwnPropertyNames;var cee=Object.getPrototypeOf,uee=Object.prototype.has... L8: `:10,t=typeof i=="string"?"\r":13;return i[i.length-1]===e&&(i=i.slice(0,i.length-1)),i[i.length-1]===t&&(i=i.slice(0,i.length-1)),i}});var mx=b((j9e,Wc)=>{"use strict";var qc=J("p... L9: ${o.message}`:_,g=[m,e,i].filter(Boolean).join(` L10: `);return d?(o.originalMessage=o.message,o.message=g):o=new Error(g),o.shortMessage=m,o.command=n,o.escapedCommand=r,o.exitCode=s,o.signal=a,o.signalDescription=f,o.stdout=i,o.stde... L11: `)];for(let[u,l]of c.entries()){if(o+=l,Dp.has(l)){let{groups:f}=new RegExp(`(

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/create-cedar-app.jsView on unpkg · L6

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/create-cedar-app.jsView on unpkg

2L3: const require = (await import("node:module")).createRequire(import.meta.url); L4: const __filename = (await import("node:url")).fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/create-cedar-app.jsView on unpkg · L2