fixmind@1.0.26: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

fixmind@1.0.26: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/src/cli-sync.jsView file

11patternName = supabase_service_key severity = critical line = 11 matchedText = const DE...Bo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli-sync.jsView on unpkg · L11

11patternName = supabase_service_key severity = critical line = 11 matchedText = const DE...Bo";

Critical

Secret Pattern

Supabase service role key (JWT) in dist/src/cli-sync.js

dist/src/cli-sync.jsView on unpkg · L11

dist/dashboard/assets/LessonRoutePage-BdGRH8gN.jsView file

1import{n as e,r as t,t as n}from"./proactive-memory-VE7UWgBo.js";import{_ as r,a as i,b as a,c as o,d as s,f as c,g as l,h as u,i as d,m as f,n as p,o as m,r as h,t as g,u as _,v}f... L2: https://github.com/highlightjs/highlight.js/issues/2277`),i=e,r=t),n===void 0&&(n=!0);let a={code:r,language:i};z(`before:highlight`,a);let o=a.result?a.result:v(a.language,a.code,...

High

Child Process

Package source references child process execution.

dist/dashboard/assets/LessonRoutePage-BdGRH8gN.jsView on unpkg · L1

dist/src/setup.jsView file

268return true; L269: // With `shell: true` on Windows, a missing command no longer surfaces as ENOENT; L270: // cmd.exe instead exits non-zero and writes this message to stderr.

High

Shell

Package source references shell execution.

dist/src/setup.jsView on unpkg · L268

dist/dashboard/assets/index-BC_QIGNI.jsView file

11L12: Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let u=N(),d;if(t){let e=typeof t==`string`?O(t):t;E(c===`/`||e.pathname?.startsWith(c),`Wh...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/dashboard/assets/index-BC_QIGNI.jsView on unpkg · L11

dist/src/sync-backend.jsView file

1import { exec } from "node:child_process"; L2: import dns from "node:dns"; L3: import http from "node:http"; ... L10: const OAUTH_TIMEOUT_MS = 5 * 60 * 1000; L11: const ACCOUNT_URL = process.env.FIXMIND_ACCOUNT_URL ?? "https://www.fixmind.dev/account"; L12: class MemoryAuthStorage {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/sync-backend.jsView on unpkg · L1

1import { exec } from "node:child_process"; L2: import dns from "node:dns"; L3: import http from "node:http"; ... L10: const OAUTH_TIMEOUT_MS = 5 * 60 * 1000; L11: const ACCOUNT_URL = process.env.FIXMIND_ACCOUNT_URL ?? "https://www.fixmind.dev/account"; L12: class MemoryAuthStorage { ... L24: function openInBrowser(url) { L25: const command = process.platform === "win32" L26: ? `start "" "${url}"` ... L55: } L56: body::before { L57: content: ""; position: absolute; inset: 0; pointer-events: none;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/src/sync-backend.jsView on unpkg · L1

Source & flagged code

7 flagged

dist/src/cli-sync.jsView file

Lines 1-31javascript

1import { spawn } from "node:child_process";

2import { fileURLToPath } from "node:url";

3import { stdin, stdout } from "node:process";

4import { isCancel, log, password } from "@clack/prompts";

5import { readConfig, writeConfig } from "./config.js";

6import { createLessonStore, initializeDataDirectory } from "./storage.js";

7import { createSyncEngine, PRICING_URL } from "./sync.js";

8import { common, isAddressInUseError, intro, multiselect, note, optionalPort, optionString, parseList, select, startSpinner, supportedClientOptions, terminalLink, unwrap, validateClients, validateScope, greenText, text, } from "./cli-utils.js";

9import { configureClients, configureInstructions, configurePermissions, detectClients, genericMcpConfiguration } from "./setup.js";

10const DEFAULT_SUPABASE_URL = "https://jpczzgekindvuivnwjuw.supabase.co";

11const DEFAULT_SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpwY3p6Z2VraW5kdnVpdm53anV3Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3ODIwNzEyMjEsImV4cCI6MjA5NzY0NzIyMX0.qG-9H5BZi3sKHVQrzL3iI9ALmJgoTizLCU4Bxzpw0Bo";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src/cli-sync.jsView on unpkg · L11

Critical

Secret Pattern

Supabase service role key (JWT) in dist/src/cli-sync.js

dist/src/cli-sync.jsView on unpkg · L11

12export async function setup(options) {

13 const paths = initializeDataDirectory();

14 const config = readConfig();

15 const detected = detectClients();

16 const supplied = parseList(optionString(options.client));

17 let clients = supplied.length ? validateClients(supplied) : detected;

18 const suppliedScope = optionString(options.scope);

19 let scope = suppliedScope ? validateScope(suppliedScope) : "user";

20 const projectDirectory = process.cwd();

21 const captureModeInput = optionString(options["capture-mode"]);

22 const interactive = stdin.isTTY && stdout.isTTY;

23 if (interactive) {

24 intro("Configure Learning Lessons", common);

25 }

26 const captureMode = captureModeInput

27 ? validateCaptureMode(captureModeInput)

28 : await chooseCaptureMode(config.captureMode, interactive);

29 if (!options["dry-run"] && captureMode !== config.captureMode) {

30 writeConfig({ ...config, captureMode });

31 }

dist/dashboard/assets/LessonRoutePage-BdGRH8gN.jsView file

Lines 1-6javascript

1import{n as e,r as t,t as n}from"./proactive-memory-VE7UWgBo.js";import{_ as r,a as i,b as a,c as o,d as s,f as c,g as l,h as

dist/src/setup.jsView file

Lines 248-278javascript

248 }

249 catch {

250 return false;

251 }

252}

253function runCommand(command, args) {

254

dist/dashboard/assets/index-BC_QIGNI.jsView file

Lines 1-12javascript

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/LessonRoutePage-BdGRH8gN.js","assets/proactive-memory-VE7UWgBo.js","assets/PracticePage-CXZwNouy.js"])))=>i.map(i

dist/src/sync-backend.jsView file

Lines 1-21javascript

1import { exec } from "node:child_process";

2import dns from "node:dns";

3import http from "node:http";

4import { createClient } from "@supabase/supabase-js";