getlib-mcp@1.1.4: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

getlib-mcp@1.1.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/mcp.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp.js: import{createRequire as cte}from"node:module";var rte=Object.create;var{getPrototypeOf:ste,defineProperty:Sd,getOwnPropertyNames:qQ}=Object;var vA=Object.prototype.hasOwnProperty;f... `),()=>this.onerror("timeout"),(n)=>{if(!n||n.status!==200)this.awaitingBatchAck=!1,this.onerror(n&&n.status),this.closeAndRetry(1011,"internal server error",!1);else if(r<e.length... });`;class aP{get endPoint(){return this.socketAdapter.endPoint}get timeout(){return this.socketAdapter.timeout}get transport(){return this.socketAdapter.transport}get heartbeatCal... \r=`.split(""),Une=(()=>{let e=Array(128);for(let t=0;t<e.length;t+=1)e[t]=-1;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp.jsView on unpkg

224L225: `);else f.write(` L226: if (${I}.issues.length) {${y(I,F)} ... L238: L239: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let i of e.seen.entries()){let a=i[1];if(t===i[0]){o(i);continue}if(e.external){let l=e.exter... L240: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r=o+1;continue}r++}return new XW(t)}async function rJ(e,...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L224

173`,{mode:384}).catch(()=>{}),af=e,e}function pU(e){let t=parseInt(e.slice(0,4),16),r=parseInt(e.slice(4,8),16);return(t.toString(2).padStart(16,"0")+r.toString(2).padStart(16,"0")).... L174: `);if(n===-1)return e+s;return e.slice(0,n+1)+s+e.slice(n+1)}import{createHash as F_e}from"crypto";class wl{store=new Map;maxSize;constructor(e=200){this.maxSize=e}get(e){let t=thi... L175: `).replace(/\r/g,`

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/mcp.jsView on unpkg · L173

224Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/mcp.js L224: L225: `);else f.write(` L226: if (${I}.issues.length) {${y(I,F)} ... L238: L239: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let i of e.seen.entries()){let a=i[1];if(t===i[0]){o(i);continue}if(e.external){let l=e.exter... L240: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r=o+1;continue}r++}return new XW(t)}async function rJ(e,...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/mcp.jsView on unpkg · L224

•Trigger-reachable fixed external POST callback chain: manifest.bin -> dist/mcp.js import{createRequire as cte}from"node:module";var rte=Object.create;var{getPrototypeOf:ste,defineProperty:Sd,getOwnPropertyNames:qQ}=Object;var vA=Object.prototype.hasOwnProperty;f... Suggested solution: ${e.workaround}`;throw Error(t)}static isWebSocketSupported(){try{return this.detectEnvironment().type==="native"}catch(e){return!1}}}gT.WebSocketFactory=KE;gT.... `),()=>this.onerror("timeout"),(n)=>{if(!n||n.status!==200)this.awaitingBatchAck=!1,this.onerror(n&&n.status),this.closeAndRetry(1011,"internal server error",!1);else if(r<e.length... setInterval(() => postMessage({ event: "keepAlive" }), e.data.interval); });`;class aP{get endPoint(){return this.socketAdapter.endPoint}get timeout(){return this.soc

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/mcp.jsView on unpkg

163patternName = generic_password severity = medium line = 163

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp.jsView on unpkg · L163

187L188: Please provide a specific library name to look up.`;var Ep=new Map;function ot(e){if(e.name.length===0)throw Error("Tool name must not be empty");if(Ep.has(e.name))throw Error(`Dup... L189: `).filter((o)=>o),s=Math.min(...r.map((o)=>o.length-o.trimStart().length)),n=r.map((o)=>o.slice(s)).map((o)=>" ".repeat(this.indent*2)+o);for(let o of n)this.content.push(o)}compil...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L187

Source & flagged code

7 flagged

dist/mcp.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/mcp.js: import{createRequire as cte}from"node:module";var rte=Object.create;var{getPrototypeOf:ste,defineProperty:Sd,getOwnPropertyNames:qQ}=Object;var vA=Object.prototype.hasOwnProperty;f... `),()=>this.onerror("timeout"),(n)=>{if(!n||n.status!==200)this.awaitingBatchAck=!1,this.onerror(n&&n.status),this.closeAndRetry(1011,"internal server error",!1);else if(r<e.length... });`;class aP{get endPoint(){return this.socketAdapter.endPoint}get timeout(){return this.socketAdapter.timeout}get transport(){return this.socketAdapter.transport}get heartbeatCal... \r=`.split(""),Une=(()=>{let e=Array(128);for(let t=0;t<e.length;t+=1)e[t]=-1;

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/mcp.jsView on unpkg

224L225: `);else f.write(` L226: if (${I}.issues.length) {${y(I,F)} ... L238: L239: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let i of e.seen.entries()){let a=i[1];if(t===i[0]){o(i);continue}if(e.external){let l=e.exter... L240: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r=o+1;continue}r++}return new XW(t)}async function rJ(e,...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/mcp.jsView on unpkg · L224

173`,{mode:384}).catch(()=>{}),af=e,e}function pU(e){let t=parseInt(e.slice(0,4),16),r=parseInt(e.slice(4,8),16);return(t.toString(2).padStart(16,"0")+r.toString(2).padStart(16,"0")).... L174: `);if(n===-1)return e+s;return e.slice(0,n+1)+s+e.slice(n+1)}import{createHash as F_e}from"crypto";class wl{store=new Map;maxSize;constructor(e=200){this.maxSize=e}get(e){let t=thi... L175: `).replace(/\r/g,`

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/mcp.jsView on unpkg · L173

224Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/mcp.js L224: L225: `);else f.write(` L226: if (${I}.issues.length) {${y(I,F)} ... L238: L239: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let i of e.seen.entries()){let a=i[1];if(t===i[0]){o(i);continue}if(e.external){let l=e.exter... L240: `,r);r=n===-1?e.length:n;continue}if(s==="/"&&e[r+1]==="*"){let n=e.indexOf("*/",r+2),o=n===-1?e.length-1:n+1;t.push([r,o]),r=o+1;continue}r++}return new XW(t)}async function rJ(e,...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/mcp.jsView on unpkg · L224

•Trigger-reachable fixed external POST callback chain: manifest.bin -> dist/mcp.js import{createRequire as cte}from"node:module";var rte=Object.create;var{getPrototypeOf:ste,defineProperty:Sd,getOwnPropertyNames:qQ}=Object;var vA=Object.prototype.hasOwnProperty;f... Suggested solution: ${e.workaround}`;throw Error(t)}static isWebSocketSupported(){try{return this.detectEnvironment().type==="native"}catch(e){return!1}}}gT.WebSocketFactory=KE;gT.... `),()=>this.onerror("timeout"),(n)=>{if(!n||n.status!==200)this.awaitingBatchAck=!1,this.onerror(n&&n.status),this.closeAndRetry(1011,"internal server error",!1);else if(r<e.length... setInterval(() => postMessage({ event: "keepAlive" }), e.data.interval); });`;class aP{get endPoint(){return this.socketAdapter.endPoint}get timeout(){return this.soc

High

Trigger Reachable External Post Callback

A manifest entrypoint or package-local install chain reaches a fixed external POST callback.

dist/mcp.jsView on unpkg

163patternName = generic_password severity = medium line = 163

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/mcp.jsView on unpkg · L163

187L188: Please provide a specific library name to look up.`;var Ep=new Map;function ot(e){if(e.name.length===0)throw Error("Tool name must not be empty");if(Ep.has(e.name))throw Error(`Dup... L189: `).filter((o)=>o),s=Math.min(...r.map((o)=>o.length-o.trimStart().length)),n=r.map((o)=>o.slice(s)).map((o)=>" ".repeat(this.indent*2)+o);for(let o of n)this.content.push(o)}compil...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp.jsView on unpkg · L187