elephant-tusk-runner: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

elephant-tusk-runner: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

bin/tusk.jsView file

9L10: import { spawn, execSync, exec } from 'node:child_process'; L11: import path from 'node:path';

High

Child Process

Package source references child process execution.

bin/tusk.jsView on unpkg · L9

53L54: const execAsync = promisify(exec); L55: const __filename = fileURLToPath(import.meta.url);

High

Shell

Package source references shell execution.

bin/tusk.jsView on unpkg · L53

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/tusk.js: const remoteLicenseServerEndpoint = 'https://coodesrc.com/tusk/status.php'; console.log(` 👉 \x1b[4;34mhttps://coodesrc.com/tusk/\x1b[0m 👈\n`); console.log("\x1b[34m🌱 [TUSK]: Running database schema migrations followed by automated mock seeding...\x1b[0m"); console.log(` nuke Purge node_modules/lockfiles and trigger clean re-install`); node: "https://github.com/expressjs/express-starter", laravel: "https://github.com/laravel/laravel", symfony: "https://github.com/symfony/skeleton", react: "https://github.[redacted]-vite/template-react",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/tusk.jsView on unpkg

9Detached bundled service listener: bin/tusk.js spawns server.js; helper exposes a broad-bound HTTP listener. L9: L10: import { spawn, execSync, exec } from 'node:child_process'; L11: import path from 'node:path'; ... L55: const __filename = fileURLToPath(import.meta.url); L56: const __dirname = path.dirname(__filename); L57: const rootDirectory = path.resolve(__dirname, '..'); ... L71: let localLicenseTokenValue = ''; L72: const remoteLicenseServerEndpoint = 'https://coodesrc.com/tusk/status.php'; L73: const localLicenseFilePath = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.tusk-license'); L74: ... L97: headers: { 'Content-Type': 'application/json' }, L98: body: JSON.stringify({

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/tusk.jsView on unpkg · L9

803L804: // Run degit via npx to support monorepos, subfolders, and normal repos seamlessly L805: const scaffoldProcess = spawn( L806: 'npx',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/tusk.jsView on unpkg · L803

server.jsView file

1// process.env.NODE_PTY_FORCE_WINPTY = '1'; L2: import express from 'express'; L3: // import { exec } from 'child_process'; L4: import { spawn, exec, execSync } from 'child_process'; ... L10: import AdmZip from 'adm-zip'; L11: import net from 'net'; L12: import { MongoClient } from 'mongodb';

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

server.jsView on unpkg · L1

bin/utils.jsView file

5import os from 'node:os'; L6: import { exec, execSync, spawn } from 'node:child_process'; L7: import { promisify } from 'node:util'; ... L25: L26: const targetProjectDirectoryAbsolute = path.resolve(process.cwd(), projectFolderPath); L27: const primaryEntrypointScriptAbsolute = path.resolve(targetProjectDirectoryAbsolute, entryScriptFilename); ... L90: * Helper utility to securely capture a hidden terminal password string input. L91: * Suppresses standard stdout echo streams and displays replacement asterisks instead. L92: */ ... L99: L100: process.stdout.write(queryPrompt); L101: let rawSecretBuffer = "";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

bin/utils.jsView on unpkg · L5

5Trigger-reachable chain: manifest.main -> bin/tusk.js -> bin/utils.js L5: import os from 'node:os'; L6: import { exec, execSync, spawn } from 'node:child_process'; L7: import { promisify } from 'node:util'; ... L25: L26: const targetProjectDirectoryAbsolute = path.resolve(process.cwd(), projectFolderPath); L27: const primaryEntrypointScriptAbsolute = path.resolve(targetProjectDirectoryAbsolute, entryScriptFilename); ... L90: * Helper utility to securely capture a hidden terminal password string input. L91: * Suppresses standard stdout echo streams and displays replacement asterisks instead. L92: */ ... L99: L100: process.stdout.write(queryPrompt); L101: let rawSecretBuffer = "";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

bin/utils.jsView on unpkg · L5

•matchType = previous_version_dangerous_delta matchedPackage = elephant-tusk-runner@1.0.6 matchedIdentity = npm:ZWxlcGhhbnQtdHVzay1ydW5uZXI:1.0.6 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Source & flagged code

10 flagged

bin/tusk.jsView file

Lines 1-73javascript

1#!/usr/bin/env node

2

3/**

4 * Elephant Project Orchestration Studio - Unified CLI Runner Platform

5 * Location: bin/tusk.js

6 * Feature: Resolved asynchronous control flow bypassing via explicit top-level

7 * async main wrapper constraints.

8 */

9

10import { spawn, execSync, exec } from 'node:child_process';

11import path from 'node:path';

High

Child Process

Package source references child process execution.

bin/tusk.jsView on unpkg · L9

12// import fs from 'node:fs/promises';

13

14import fs from 'node:fs';

15import fsp from 'node:fs/promises';

16// import path from 'node:path';

17// import readline from 'node:readline';

18

19import { fileURLToPath } from 'node:url';

20import { promisify } from 'node:util';

21import readline from 'node:readline';

22

23import {

24 displayLiveSystemDiagnostics,

25 purgeDevelopmentSystemClutter,

26 generateSecureKeysAndCopyToClipboard,

27 establishAbsoluteSymbolicLinks,

28 identifyHeavyStorageDirectories,

29 triggerConventionalCommitWizard,

33 extractCodebaseTechnicalDebt,

34 decoupleSubroutines,

35 exploreLocalMysqlDatabaseLayers,

36 processDeveloperBugSubmissionFlow,

37 compressTargetWorkspaceEntity,

38 runThreatSignaturesScanMatrix,

39 locateForgottenFileWithWildcard,

40 diagnoseAndManageSystemPerformanceStress,

41 runBinarySandboxHeuristicsAudit,

42 initiateRealtimeNetworkPacketDiagnostics,

43 analyzeSystemHardwareMemoryPartitionMaps,

44 setPersistentSystemEnvironmentVariable,

45 modifySystemDisplayBrightness,

46 toggleSystemNightModeFilter,

47 assessSystemBatteryHealthTelemetry,

48 removeFloatingCodebaseDebugLogs,

49 executeIsolatedAiAssistanceQuery,

50 compileAndBuildLocalWorkspacePipeline

51 } from './utils.js';

52

53

54const execAsync = promisify(exec);

55const __filename = fileURLToPath(import.meta.url);

High

Shell

Package source references shell execution.

bin/tusk.jsView on unpkg · L53

56const __dirname = path.dirname(__filename);

57const rootDirectory = path.resolve(__dirname, '..');

58

59const consoleArgumentsMatrix = process.argv.slice(2);

60const structuralSubcommandToken = consoleArgumentsMatrix[0] ? consoleArgumentsMatrix[0].toLowerCase().trim() : '';

61

62const MASTER_SERVER_PORT = 4201;

63

64/**

65 * PRIMARY TASK RUNNER CONTEXT ENTRY POINT

66 * Wraps validation metrics securely to isolate and block command slip-through.

67 */

68

69async function main() {

70 // 1. Initialize Interception Mappings & Resolve Local Token References

71 let localLicenseTokenValue = '';

72 const remoteLicenseServerEndpoint = 'https://coodesrc.com/tusk/status.php';

73 const localLicenseFilePath = path.join(process.env.HOME || process.env.USERPROFILE || '.', '.tusk-license');

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

bin/tusk.jsView on unpkg · L9

Lines 783-823javascript

783

784// const { spawn } = require('child_process');

785

786function dispatchInteractiveScaffoldBootstrapTransaction(frameworkKey) {

787 const key = frameworkKey.toLowerCase();

788 const targetUrl = frameworkBoilerplateRepositoryRoutes[key];

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. bin/tusk.js: const remoteLicenseServerEndpoint = 'https://coodesrc.com/tusk/status.php'; console.log(` 👉 \x1b[4;34mhttps://coodesrc.com/tusk/\x1b[0m 👈\n`); console.log("\x1b[34m🌱 [TUSK]: Running database schema migrations followed by automated mock seeding...\x1b[0m"); console.log(` nuke Purge node_modules/lockfiles and trigger clean re-install`); node: "https://github.com/expressjs/express-starter", laravel: "https://github.com/laravel/laravel", symfony: "https://github.com/symfony/skeleton", react: "https://github.[redacted]-vite/template-react",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

bin/tusk.jsView on unpkg

server.jsView file

Lines 1-21javascript

1// process.env.NODE_PTY_FORCE_WINPTY = '1';

2import express from 'express';

3// import { exec } from 'child_process';

4import { spawn, exec, execSync } from 'child_process';

5import path from 'path';

6import

bin/utils.jsView file

Lines 1-25javascript

1

2

3import fs from 'node:fs';

4import path from 'node:path';

5import os from 'node:os';

6import { exec, execSync, spawn } from