iclavue@11.3.5: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

iclavue@11.3.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-pager.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/mao-command.jsView file

4var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: GFS4: `),console.error(m)},"debug"));fs6[gracefulQueue]||(queue=global[gracefulQueue]||[],publishQueue(fs6,queue),fs6.close=(function(fs$close){function close(fd,cb){return fs$clos... L6: `,tmpPath=`${filePath}.${process4.pid}.${Date.now()}.${Math.random().toString(36).slice(2,8)}.tmp`;try{fs.writeFileSync(tmpPath,payload,"utf8"),fs.renameSync(tmpPath,filePath)}catc...

High

Child Process

Package source references child process execution.

dist/mao-command.jsView on unpkg · L4

•matchType = normalized_sha256 matchedPackage = iclavue@11.0.12 matchedPath = dist/mao-command.js matchedIdentity = npm:aWNsYXZ1ZQ:11.0.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/mao-command.jsView on unpkg

dist/openai-responses-adapter.jsView file

3// clavue v11.3.5 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: /* [wrapped with `+details+`] */ ... L22: `)+source+`return __p L23: }`;var result2=attempt_default(function(){return Function(importsKeys,sourceURL+"return "+source).apply(void 0,importsValues)});if(result2.source=source,isError_default(result2))th... L24: `):[]}};_LineDecoder_buffer=new WeakMap,_LineDecoder_carriageReturnIndex=new WeakMap;LineDecoder.NEWLINE_CHARS=new Set([` ... L61: new Anthropic({ apiKey, dangerouslyAllowBrowser: true }); L62: `);this.baseURL=options.baseURL,this.timeout=options.timeout??_a.DEFAULT_TIMEOUT,this.log

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/openai-responses-adapter.jsView on unpkg · L3

75`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L76: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L77: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... ... L79: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");let serv... L80: `,CRLF_BYTES=textEncoder.encode(CRLF),CRLF_BYTES_COUNT=2,FormDataPart=class{st

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openai-responses-adapter.js

dist/native/clavue-pager-darwin-x64View file

•path = dist/native/clavue-pager-darwin-x64 kind = native_binary sizeBytes = 5340344 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-darwin-x64View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6630 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 17499087 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17499087 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/provider-setup.jsView file

•matchType = normalized_sha256 matchedPackage = iclavue@11.0.12 matchedPath = dist/provider-setup.js matchedIdentity = npm:aWNsYXZ1ZQ:11.0.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-setup.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 59-99json

59 "url": "git+https://github.com/mycode699/clavue.git"

60 },

61 "publishConfig": {

62 "access": "public"

63 },

64 "bundleDependencies": [

65 "@anthropic-ai/sandbox-runtime",

66 "@opentelemetry/api",

67 "@opentelemetry/api-logs",

68 "@opentelemetry/core",

69 "@opentelemetry/resources",

70 "@opentelemetry/sdk-logs",

71 "@opentelemetry/sdk-metrics",

72 "@opentelemetry/sdk-trace-base",

73 "@opentelemetry/semantic-conventions",

74 "ajv",

75 "lru-cache",

76 "qrcode"

77 ],

78 "scripts": {

79 "postinstall": "node scripts/postinstall-pager.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

80 "prepublishOnly": "npm run check:pager-native-publish",

81 "build": "npm run check:release && npm pack --dry-run",

82 "build:knowledge": "node scripts/build-project-knowledge.mjs",

83 "vendor:ripgrep": "node scripts/vendor-ripgrep.mjs",

84 "check": "npm run check:quick",

85 "check:fast": "npm run check:types && npm run check:source-purity && npm run check:boundaries && npm run check:architecture-budget && npm run check:upgrade-hygiene && npm run check:cited-path-boundary && npm run check:intent-corpus && npm run check:ink-removal && npm run check:pager-tui-coverage && npm run check:lead-capabilities && npm run check:ui-protocol-registry && npm run test:fast && npm run check:startup",

86 "check:quick": "npm run validate:repo && npm run check:test-hygiene && npm run check:source-purity && npm run check:boundaries && npm run check:ui-action-allowlist && npm run check:architecture-budget && npm run check:types && npm run test:fast && npm run check:test-hygiene && npm run check:pager-ui && npm run check:eval-baseline && npm run test:system-contract",

87 "check:release": "npm run vendor:ripgrep && npm run validate:repo && npm run check:test-hygiene && npm run verify:dist-clean && npm run verify:dist && npm run verify:source-build && npm run check:source-purity && npm run check:boundaries && npm run check:architecture-budget && npm run check:types && npm run test:fast && npm run check:test-hygiene && npm run check:pager-release && npm run check:flywheel",

88 "check:hygiene": "npm run validate:repo",

89 "check:upgrade-hygiene": "node scripts/check-upgrade-hygiene.mjs",

90 "check:ink-removal": "node scripts/check-ink-removal.mjs",

91 "check:test-hygiene": "node scripts/check-test-tmp-hygiene.mjs",

92 "test:clean-tmp": "node scripts/clean-test-tmp.mjs",

93 "check:source-purity": "node scripts/check-source-purity.mjs",

94 "check:boundaries": "node scripts/check-architecture-boundaries.mjs",

95 "check:commits": "node scripts/check-commit-message.mjs --range HEAD~1..HEAD",

96 "check:architecture-budget": "node scripts/check-architecture-budget.mjs",

97 "check:knip": "node scripts/check-knip-baseline.mjs",

98 "check:types": "node scripts/check-types.mjs",

99 "verify:source-build": "node scripts/build-plugin.mjs",

dist/mao-command.jsView file

Lines 1-24javascript

1import { createRequire as __createRequire } from "node:module";

2const require = __createRequire(import.meta.url);

3// clavue v11.3.5 mao-command (built from source)

4var __create=

dist/openai-responses-adapter.jsView file

3// clavue v11.3.5 openai-responses-adapter (built from source) L4: var __create=Object.create;var __defProp=Object.defineProperty;var __getOwnPropDesc=Object.getOwnPropertyDescriptor;var __getOwnPropNames=Object.getOwnPropertyNames;var __getProtoO... L5: /* [wrapped with `+details+`] */ ... L22: `)+source+`return __p L23: }`;var result2=attempt_default(function(){return Function(importsKeys,sourceURL+"return "+source).apply(void 0,importsValues)});if(result2.source=source,isError_default(result2))th... L24: `):[]}};_LineDecoder_buffer=new WeakMap,_LineDecoder_carriageReturnIndex=new WeakMap;LineDecoder.NEWLINE_CHARS=new Set([` ... L61: new Anthropic({ apiKey, dangerouslyAllowBrowser: true }); L62: `);this.baseURL=options.baseURL,this.timeout=options.timeout??_a.DEFAULT_TIMEOUT,this.log

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/openai-responses-adapter.jsView on unpkg · L3

75`)===-1){debug3("have not received end of HTTP headers yet..."),read();return}let firstLine=buffered.toString("ascii",0,buffered.indexOf(`\r L76: `)),statusCode=+firstLine.split(" ")[1];debug3("got proxy server response: %o",firstLine),resolve9({statusCode,buffered})}__name(ondata,"ondata"),socket.on("error",onerror),socket.... L77: `;proxy.auth&&(headers["Proxy-Authorization"]=`Basic ${Buffer.from(proxy.auth).toString("base64")}`);let{host,port,secureEndpoint}=opts;isDefaultPort(port,secureEndpoint)||(host+=`... ... L79: `);let{statusCode,buffered}=yield proxyResponsePromise;if(statusCode===200){if(req.once("socket",resume2),opts.secureEndpoint){debug3("Upgrading socket connection to TLS");let serv... L80: `,CRLF_BYTES=textEncoder.encode(CRLF),CRLF_BYTES_COUNT=2,FormDataPart=class{st

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openai-responses-adapter.js

dist/native/clavue-pager-darwin-x64View file

•path = dist/native/clavue-pager-darwin-x64 kind = native_binary sizeBytes = 5340344 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/native/clavue-pager-darwin-x64View on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6630 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 17499087 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 17499087 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/provider-setup.jsView file

•matchType = normalized_sha256 matchedPackage = iclavue@11.0.12 matchedPath = dist/provider-setup.js matchedIdentity = npm:aWNsYXZ1ZQ:11.0.12 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/provider-setup.jsView on unpkg