hillclimb: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

hillclimb: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

dist/pattern-worker.jsView file

1189patternName = private_key_ec severity = critical line = 1189 matchedText = regex: "...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/pattern-worker.jsView on unpkg · L1189

1189patternName = private_key_ec severity = critical line = 1189 matchedText = regex: "...--",

Critical

Secret Pattern

EC private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L1189

1974patternName = private_key_rsa severity = critical line = 1974 matchedText = regex: "...-)",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L1974

3199patternName = private_key_rsa severity = critical line = 3199 matchedText = regex: "...--",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3199

3204patternName = private_key_rsa severity = critical line = 3204 matchedText = regex: "...--",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3204

3359patternName = private_key_openssh severity = critical line = 3359 matchedText = regex: "...--",

Critical

Secret Pattern

OpenSSH private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3359

dist/cli.jsView file

16var MAX_SNAPSHOT_LIMIT_OVERRIDE_BYTES = 100 * 1024 * 1024; L17: var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".hillclimb"); L18: function normalizeProjectConfig(raw) { ... L56: function configDir() { L57: return process.env.HILLCLIMB_CONFIG_DIR ?? DEFAULT_CONFIG_DIR; L58: } ... L64: const raw = await fs.promises.readFile(configPath(), "utf-8"); L65: const parsed = JSON.parse(raw); L66: if (!parsed.projects || typeof parsed.projects !== "object") { ... L116: // src/git.ts L117: import { execSync } from "child_process"; L118: import path2 from "path";

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.jsView on unpkg · L16

16Trigger-reachable chain: manifest.bin -> dist/cli.js L16: var MAX_SNAPSHOT_LIMIT_OVERRIDE_BYTES = 100 * 1024 * 1024; L17: var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".hillclimb"); L18: function normalizeProjectConfig(raw) { ... L56: function configDir() { L57: return process.env.HILLCLIMB_CONFIG_DIR ?? DEFAULT_CONFIG_DIR; L58: } ... L64: const raw = await fs.promises.readFile(configPath(), "utf-8"); L65: const parsed = JSON.parse(raw); L66: if (!parsed.projects || typeof parsed.projects !== "object") { ... L116: // src/git.ts L117: import { execSync } from "child_process"; L118: import path2 from "path";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L16

•matchType = previous_version_dangerous_delta matchedPackage = hillclimb@0.7.0 matchedIdentity = npm:aGlsbGNsaW1i:0.7.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Source & flagged code

16 flagged

dist/pattern-worker.jsView file

Lines 1169-1209javascript

1169 regex: "(?:dwolla).{0,40}\\b([a-zA-Z-0-9]{50})\\b",

1170 confidence: "high"

1171 },

1172 {

1173 name: "Dynalist",

1174 regex: "(?:dynalist).{0,40}\\b([a-zA-Z0-9-_]{128})\\b",

1175 confidence: "high"

1176 },

1177 {

1178 name: "Dynatrace token",

1179 regex: "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}",

1180 confidence: "high"

1181 },

1182 {

1183 name: "Dyspatch",

1184 regex: "(?:dyspatch).{0,40}\\b([A-Z0-9]{52})\\b",

1185 confidence: "high"

1186 },

1187 {

1188 name: "EC",

1189 regex: "-----BEGIN EC PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/pattern-worker.jsView on unpkg · L1189

Critical

Secret Pattern

EC private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L1189

1190 confidence: "high"

1191 },

1192 {

1193 name: "Eagleeyenetworks - 1",

1194 regex: "(?:eagleeyenetworks).{0,40}\\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\\b",

1195 confidence: "high"

1196 },

1197 {

1198 name: "Eagleeyenetworks - 2",

1199 regex: "(?:eagleeyenetworks).{0,40}\\b([a-zA-Z0-9]{15})\\b",

1200 confidence: "high"

1201 },

1202 {

1203 name: "Easyinsight - 1",

1204 regex: "(?:easyinsight|easy-insight).{0,40}\\b([a-zA-Z0-9]{20})\\b",

1205 confidence: "high"

1206 },

1207 {

1208 name: "Easyinsight - 2",

1209 regex: "(?:easyinsight|easy-insight).{0,40}\\b([0-9Aa-zA-Z]{20})\\b",

Lines 1954-1994javascript

1954 regex: "ghp_[0-9a-zA-Z]{36}",

1955 confidence: "high"

1956 },

1957 {

1958 name: "Github Refresh Token",

1959 regex: "ghr_[0-9a-zA-Z]{76}",

1960 confidence

Lines 3179-3219javascript

3179 regex: "(?:qualaroo).{0,40}\\b([a-z0-9A-Z=]{64})",

3180 confidence: "high"

3181 },

3182 {

3183 name: "Qubole",

3184 regex: "(?:qubole).{0,40}\\b([0-9a-z]{64})

3204patternName = private_key_rsa severity = critical line = 3204 matchedText = regex: "...--",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3204

3359patternName = private_key_openssh severity = critical line = 3359 matchedText = regex: "...--",

Critical

Secret Pattern

OpenSSH private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3359

dist/cli.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2

3// src/cli.ts

4import fs23 from "fs";

5import path24 from "path";

6import * as p6 from