dexbot@1.1.11: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

dexbot@1.1.11: Suspicious npm security report (Warn) | LPM Firewall

dist/modules/chain_keys.jsView file

Lines 664-704javascript

664 if (confirmPassword === '\x1b')

665 return currentSecret;

666 if (newPassword !== confirmPassword) {

667 console.log('Passwords do not match!');

668 return currentSecret;

669 }

670 if (!newPassword) {

671 console.log('New master password cannot be empty.');

672 return currentSecret;

673 }

674 const decryptedKeys = {};

675 try {

676 for (const [name, account] of Object.entries(accountsData.accounts)) {

677 decryptedKeys[name] = decrypt(account.encryptedKey, oldSecret);

678 }

679 }

680 catch (error) {

681 // Clear any partially-decrypted keys before returning

682 for (const key of Object.keys(decryptedKeys))

683 delete decryptedKeys[key];

684 console.log('Failed to decrypt stored keys with the current master password:', error.message);

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/modules/chain_keys.jsView on unpkg · L684

685 return currentSecret;

686 }

687 const newSecret = setupModernVault(accountsData, newPassword);

688 for (const [name, account] of Object.entries(accountsData.accounts)) {

689 account.encryptedKey = encrypt(decryptedKeys[name], newSecret);

690 delete decryptedKeys[name];

691 }

692 // V8 strings are immutable and cannot be zeroed; deleting the references

693 // allows GC to collect them. The real protection is that the window

694 // between decrypt and re-encrypt is now minimized to the loop body.

695 saveAccounts(accountsData);

696 console.log('Master password updated successfully.');

697 return newSecret;

698}

699/**

700 * Save accounts data to profiles/keys.json atomically with restrictive permissions.

701 * Writes to a temp file in the same directory, fsyncs, then renames over the target.

702 * The file is always created with mode 0o600 so that even if the calling process

703 * inherited a permissive umask (e.g. 0o022), the key material is never world-readable.

704 *

dist/pm2.jsView file

Lines 48-114javascript

48 * - Filters only active bots (active !== false)

49 * - If bot-name provided, filters to only that bot

50 * - In claw-only mode, generates only the credential daemon app

51 * - Each bot configured with:

52 * * Unique app name

53 * * Log file paths

54 * * Restart/memory policies

55 *

56 * Step 3: AUTHENTICATION & CLEANUP

57 * - Cleans up stale daemon socket files

58 * - Prompts interactively for the unlock secret once at startup

59 * - Authenticates against profiles/keys.json

60 * - Uses a one-shot local bootstrap channel for credential-daemon only

61 *

62 * Step 4: PM2 DAEMON STARTUP

63 * - Starts PM2 daemon if not already running

64 * - Waits for PM2 to be ready

65 * - Starts each configured bot as PM2 app

66 * - Credential daemon is started as a PM2 app after one-shot bootstrap

67 * - Bots request private keys from credential daemon via Unix socket

68 */

69const { setUmask } = require('./modules/config');

70setUmask(0o077);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/pm2.jsView on unpkg · L68

71const fs = require('fs');

72const { path } = require('./modules/path_api');

73const { spawn, exec } = require('child_process');

74const { promisify } = require('util');

High

Child Process

Package source references child process execution.

dist/pm2.jsView on unpkg · L72

75const { parseJsonWithComments } = require('./modules/order/utils/system');

76const { readBotsFileWithLock } = require('./modules/bots_file_lock');

77const { loadSettingsFile, selectActiveBotEntries } = require('./modules/bot_settings');

78const chainKeys = require('./modules/chain_keys');

79const credentialPolicy = require('./modules/credential_policy');

80const { readHeadlessPassword } = require('./modules/launcher/headless_password');

81const { ensureCredentialRuntimeDirSync, getCredentialReadyFilePath, getCredentialSocketPath, } = require('./modules/credential_runtime');

82const { buildScopedChildEnv } = require('./modules/launcher/child_env');

83const { createPasswordBootstrapServer } = require('./modules/launcher/credential_bootstrap');

84const { parsePm2Args } = require('./modules/launcher/launch_modes');

85const { setupGracefulShutdown } = require('./modules/graceful_shutdown');

86const { UPDATER, TIMING } = require('./modules/constants');

87const { PATHS } = require('./modules/paths');

88const { isDistCodeRoot, buildRuntimeScriptPath } = require('./modules/launcher/runtime_entry');

89const { getStorage } = require('./modules/storage');

90const storage = getStorage();

91const { ensureDir, safeUnlink } = require('./modules/utils/fs_utils');

92const { Config } = require('./modules/config');

93// Setup graceful shutdown handlers

94setupGracefulShutdown();

95const execAsync = promisify(exec);

96const PM2_COLORS = {

High

Shell

Package source references shell execution.

dist/pm2.jsView on unpkg · L94

97 reset: '\x1b[0m',

98 ok: '\x1b[1;92m',

99 error: '\x1b[1;31m',

100};

101function colorPm2Output(text, color, stream = process.stdout) {

102 return stream.isTTY && !Config.NO_COLOR

103 ? `${color}${text}${PM2_COLORS.reset}`

104 : text;

105}

106function pm2Success(text) {

107 return colorPm2Output(text, PM2_COLORS.ok);

108}

109function pm2Error(text) {

110 return colorPm2Output(text, PM2_COLORS.error, process.stderr);

111}

112const CODE_ROOT = __dirname;

113const ROOT = PATHS.PROJECT_ROOT;

114const BOTS_JSON = PATHS.PROFILES.BOTS_JSON;

dist/scripts/update.jsView file

Lines 405-445javascript

405 }

406 catch (_2) { }

407 }

408 // Unconditionally drop the stash entry — no orphan accumulation

409 try {

410 execSync(`git stash drop ${stashRef} 2>/dev/null`, { stdio: 'pipe', cwd: PATHS.PROJECT_ROOT });

411 }

412 catch (_) {

413 log('Warning: Could not drop stash entry — it may have been already dropped.');

414 }

415 // Check for leftover unmerged paths and resolve them

416 try {

417 const unmergedRaw = execSync('git diff --name-only --diff-filter=U', { stdio: 'pipe', cwd: PATHS.PROJECT_ROOT }).toString().trim();

418 if (unmergedRaw) {

419 const unmerged = unmergedRaw.split('\n').filter(Boolean);

420 log(`Cleaning up ${unmerged.length} unresolved merge marker(s) after stash restore...`);

421 execSync(`git checkout --theirs -- ${unmerged.join(' ')} 2>/dev/null`, { stdio: 'pipe', cwd: PATHS.PROJECT_ROOT });

422 // If package-lock.json was conflicted, regenerate it so it's

423 // consistent with the (potentially updated) package.json

424 if (unmerged.includes('package-lock.json')) {

425 log('package-lock.json was conflicted — regenerating...');

426 execSync('npm install --prefer-offline --ignore-scripts 2>&1', { stdio: 'pipe', cwd: PATHS.PROJECT_ROOT });

427 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/scripts/update.jsView on unpkg · L425

428 }

429 }

430 catch (_) { }

431 }

432 /**

433 * STEP 8: Reinstall Dependencies

434 * Updates npm packages to versions specified in package-lock.json.

435 * --ignore-scripts prevents npm from running the package `prepare` hook,

436 * which would build once here before the explicit build step below.

437 * --prefer-offline: Uses cached packages when possible

438 */

439 log('Updating dependencies...');

440 run('npm install --prefer-offline --ignore-scripts');

441 /**

442 * STEP 8b: Build TypeScript sources

443 *

444 * Do NOT rely on the npm `prepare` hook. The `prepare` script only re-fires

445 * when package.json itself changes, not when only .ts source files are