hillclimb@0.7.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

hillclimb@0.7.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

dist/pattern-worker.jsView file

1189patternName = private_key_ec severity = critical line = 1189 matchedText = regex: "...--",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/pattern-worker.jsView on unpkg · L1189

1189patternName = private_key_ec severity = critical line = 1189 matchedText = regex: "...--",

Critical

Secret Pattern

EC private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L1189

1974patternName = private_key_rsa severity = critical line = 1974 matchedText = regex: "...-)",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L1974

3199patternName = private_key_rsa severity = critical line = 3199 matchedText = regex: "...--",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3199

3204patternName = private_key_rsa severity = critical line = 3204 matchedText = regex: "...--",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3204

3359patternName = private_key_openssh severity = critical line = 3359 matchedText = regex: "...--",

Critical

Secret Pattern

OpenSSH private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3359

dist/cli.jsView file

15import path from "path"; L16: var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".hillclimb"); L17: function normalizeProjectConfig(raw) { ... L40: function configDir() { L41: return process.env.HILLCLIMB_CONFIG_DIR ?? DEFAULT_CONFIG_DIR; L42: } ... L48: const raw = await fs.promises.readFile(configPath(), "utf-8"); L49: const parsed = JSON.parse(raw); L50: if (!parsed.projects || typeof parsed.projects !== "object") { ... L95: // src/git.ts L96: import { execSync } from "child_process"; L97: import path2 from "path";

Critical

Browser Credential Phishing

Source appears to collect browser login credentials for exfiltration.

dist/cli.jsView on unpkg · L15

15Trigger-reachable chain: manifest.bin -> dist/cli.js L15: import path from "path"; L16: var DEFAULT_CONFIG_DIR = path.join(os.homedir(), ".hillclimb"); L17: function normalizeProjectConfig(raw) { ... L40: function configDir() { L41: return process.env.HILLCLIMB_CONFIG_DIR ?? DEFAULT_CONFIG_DIR; L42: } ... L48: const raw = await fs.promises.readFile(configPath(), "utf-8"); L49: const parsed = JSON.parse(raw); L50: if (!parsed.projects || typeof parsed.projects !== "object") { ... L95: // src/git.ts L96: import { execSync } from "child_process"; L97: import path2 from "path";

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L15

3616patternName = private_key_ec severity = critical line = 3616 matchedText = regex: "...--",

Critical

Secret Pattern

EC private key in dist/cli.js

Source & flagged code

15 flagged

dist/pattern-worker.jsView file

Lines 1169-1209javascript

1169 regex: "(?:dwolla).{0,40}\\b([a-zA-Z-0-9]{50})\\b",

1170 confidence: "high"

1171 },

1172 {

1173 name: "Dynalist",

1174 regex: "(?:dynalist).{0,40}\\b([a-zA-Z0-9-_]{128})\\b",

1175 confidence: "high"

1176 },

1177 {

1178 name: "Dynatrace token",

1179 regex: "dt0[a-zA-Z]{1}[0-9]{2}\\.[A-Z0-9]{24}\\.[A-Z0-9]{64}",

1180 confidence: "high"

1181 },

1182 {

1183 name: "Dyspatch",

1184 regex: "(?:dyspatch).{0,40}\\b([A-Z0-9]{52})\\b",

1185 confidence: "high"

1186 },

1187 {

1188 name: "EC",

1189 regex: "-----BEGIN EC PRIVATE KEY-----",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/pattern-worker.jsView on unpkg · L1189

Critical

Secret Pattern

EC private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L1189

1190 confidence: "high"

1191 },

1192 {

1193 name: "Eagleeyenetworks - 1",

1194 regex: "(?:eagleeyenetworks).{0,40}\\b([a-zA-Z0-9]{3,20}@[a-zA-Z0-9]{2,12}.[a-zA-Z0-9]{2,5})\\b",

1195 confidence: "high"

1196 },

1197 {

1198 name: "Eagleeyenetworks - 2",

1199 regex: "(?:eagleeyenetworks).{0,40}\\b([a-zA-Z0-9]{15})\\b",

1200 confidence: "high"

1201 },

1202 {

1203 name: "Easyinsight - 1",

1204 regex: "(?:easyinsight|easy-insight).{0,40}\\b([a-zA-Z0-9]{20})\\b",

1205 confidence: "high"

1206 },

1207 {

1208 name: "Easyinsight - 2",

1209 regex: "(?:easyinsight|easy-insight).{0,40}\\b([0-9Aa-zA-Z]{20})\\b",

Lines 1954-1994javascript

1954 regex: "ghp_[0-9a-zA-Z]{36}",

1955 confidence: "high"

1956 },

1957 {

1958 name: "Github Refresh Token",

1959 regex: "ghr_[0-9a-zA-Z]{76}",

1960 confidence

Lines 3179-3219javascript

3179 regex: "(?:qualaroo).{0,40}\\b([a-z0-9A-Z=]{64})",

3180 confidence: "high"

3181 },

3182 {

3183 name: "Qubole",

3184 regex: "(?:qubole).{0,40}\\b([0-9a-z]{64})

3204patternName = private_key_rsa severity = critical line = 3204 matchedText = regex: "...--",

Critical

Secret Pattern

RSA private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3204

3359patternName = private_key_openssh severity = critical line = 3359 matchedText = regex: "...--",

Critical

Secret Pattern

OpenSSH private key in dist/pattern-worker.js

dist/pattern-worker.jsView on unpkg · L3359

dist/cli.jsView file

Lines 1-35javascript

1#!/usr/bin/env node

2

3// src/cli.ts

4import fs21 from "fs";

5import path23 from "path";

6import * as p6 from