huu-pipe: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

huu-pipe: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

2 flagged

dist/lib/default-pipelines/huu-security-audit.jsView file

Lines 183-241javascript

183

184The recon step chose this file deliberately and left you a lead — start there: $hint

185

186=== STEP 0 — SKIP RULE ===

187SKIP IMMEDIATELY (no findings, no FAQ append) if \`$file\` matches: \`node_modules/\`, \`dist/\`, \`build/\`, \`out/\`, \`coverage/\`, \`.git/\`, \`vendor/\`, \`target/\`, \`__pycache__/\`, \`*.generated.*\`, \`*.min.js\`, \`*.min.css\`, \`*.d.ts\`, \`*.lock\`, \`*.snap\`.

188

189=== OWASP Top 10:2025 checklist ===

190(2025 reshuffle: Security Misconfiguration is now A02; Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10) are NEW; SSRF merged into A01. Source: https://owasp.org/Top10/2025/)

191For each category, the patterns to flag in \`$file\`. Where Semgrep is available (check .huu/audits/security.md section 1), prefer running \`semgrep scan --config p/owasp-top-ten --json "$file"\` and merge with the heuristic findings below.

192

193**A01:2025 — Broken Access Control** (CWE-284, CWE-285, CWE-639, CWE-862, CWE-918)

194- HTTP handlers that read a user-supplied ID and return data without an authz check (\`req.params.id\`, \`request.GET['id']\` going straight into DB without a "current user owns this" check).

195- IDOR signals: \`/api/users/:id\` patterns where the handler doesn't verify ownership (CWE-639 is in the 2025 CWE Top 25).

196- Hardcoded role bypass: \`if (user.email === "admin@*")\`.

197- SSRF (merged here in 2025): user-controlled URL into a server-side fetch — \`fetch(req.body.url)\`, \`requests.get(request.GET['url'])\`, \`HttpClient.GetAsync(userUrl)\` (CWE-918).

198- Cheat sheets: https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html ; https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

199

200**A02:2025 — Security Misconfiguration** (CWE-16, CWE-2)

201- \`DEBUG = True\` (Django/Flask) in production config files.

202- Open CORS: \`Access-Control-Allow-Origin: *\` combined with \`Access-Control-Allow-Credentials: true\`.

203- Default credentials: \`password = "password"\`, \`admin/admin\`.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/lib/default-pipelines/huu-security-audit.jsView on unpkg · L203

204- Detailed error pages leaked: \`stack=err.stack\` returned to response.

205- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html

206

207**A03:2025 — Software Supply Chain Failures** (CWE-1104, CWE-829)

208- Per-file signals only (step 5 audits the CI/workflow posture project-wide): manual fetches from unpinned CDNs (\`<script src="https://cdn.../latest/...">\`), \`curl ... | bash\` install patterns, imports of abandoned/typosquat-looking packages.

209- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.html

210

211**A04:2025 — Cryptographic Failures** (CWE-327, CWE-329, CWE-330)

212- Weak hashes: \`md5(\`, \`sha1(\`, \`crypto.createHash("md5")\`, \`hashlib.md5\`.

213- Weak ciphers: \`DES\`, \`3DES\`, \`RC4\`, \`AES.*ECB\`.

214- Hardcoded keys / IVs / salts (string literals near \`createCipheriv\`, \`Cipher(key=\`).

215- TLS misconfiguration: \`rejectUnauthorized: false\`, \`verify=False\`, \`InsecureSkipVerify: true\`, \`TLSv1\`/\`TLSv1.1\`.

216- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html

217

218**A05:2025 — Injection** (CWE-79, CWE-89, CWE-78, CWE-94 — the top 4 of the CWE Top 25 2025 all live here or in A01)

219- SQL: string concatenation / template literals with raw values into queries (\`query("SELECT * FROM users WHERE id=" + id)\`, f-string SQL).

220- OS Command: \`exec\`, \`spawn\`, \`shell=True\`, \`os.system(...)\` with user input.

221- XSS: \`innerHTML =\`, \`dangerouslySetInnerHTML\`, \`document.write(\`, \`v-html\`, Django \`mark_safe\` on user input.

222- Code injection: \`eval(\`, \`Function(\`, \`new Function(\`, Python \`exec(\`, Ruby \`eval(\`.

223- Path traversal (CWE-22, #6 in CWE Top 25 2025): user input joined into fs paths without normalization (\`path.join(base, req.params.name)\`, \`open(f"uploads/{name}")\`).

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/lib/default-pipelines/huu-security-audit.jsView on unpkg · L221

224- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html

225

226**A06:2025 — Insecure Design** (CWE-209, CWE-256, CWE-501)

227- Hard to spot statically; flag suspicious comments like \`TODO: add auth\`, \`FIXME: trust user input\`, \`HACK: skip validation\`.

228- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html

229

230**A07:2025 — Authentication Failures** (CWE-287, CWE-307)

231- Plain text password storage: \`user.password = body.password\` without a hash function.

232- Weak password validation: regex allowing short or trivial passwords.

233- Session cookies without \`httpOnly\` / \`secure\` / \`SameSite\`.

234- Missing rate limit middleware on \`/login\` / \`/auth\` routes (CWE-307).

235- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html

236

237**A08:2025 — Software or Data Integrity Failures** (CWE-502)

238- Unsafe deserialization: \`pickle.load\`, \`yaml.load\` (without \`SafeLoader\`), \`Marshal.load\`, \`ObjectInputStream.readObject\`, \`JSON.parse\` of attacker-controlled input feeding \`new Function\`.

239- Cheat sheet: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html

240

241**A09:2025 — Security Logging and Alerting Failures** (CWE-778)