Loading npm security reports…

investing@0.1.113: Suspicious npm security report (Warn) | LPM Firewall

registry / investing / 0.1.113

investing@0.1.113

Reusable investment utilities, trading agents, prediction-market analysis (PredictOS core) and financial data tools

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No malicious attack surface was identified in the inspected package entry bundles. Network and credential handling is implemented as explicit financial-data and trading service client functionality.

Static reason

High-risk behavior combination matched malicious policy.; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer must call the relevant archive, data, database, research, or payment helper.

Impact

No install-time execution, persistence, destructive action, or unconsented credential export was identified.

Mechanism

The inspected helpers validate supplied inputs and make service-specific requests using named credentials or caller-provided wallet material.

AI rationale

The manifest has no lifecycle installation hook, and inspected bundled behaviors are package-aligned archive, data, database, research, and payment helpers. No concrete malicious behavior was found.

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Why the final policy warns

The AI recommended clean. Static policy retained a warning. The static scanner classified the package as malicious with confidence of at least 85%. A critical static finding has confidence of at least 90%. These conditions do not mean that the AI confirmed malicious behavior.

Evidence for AI clean decision

The package manifest defines development and publishing commands but no install lifecycle hook.

Source & flagged code

11 flagged · loading source

dist/index-CLlAnStL-B7EBGdAY.cjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index-CLlAnStL-B7EBGdAY.cjsView on unpkg · L1

dist/archiver-web.es-B69gABHP.jsView file

1import{c as e,g as t}from"./index-D7fsk2gy.js";function r(e){throw new Error('Could not dynamically require "'+e+'". Please configure the dynamicRequireTargets or/and ignoreDynamic...

High

Eval

Package source references dynamic code evaluation.

dist/archiver-web.es-B69gABHP.jsView on unpkg · L1

dist/index-_V1Ql5Es.cjsView file

1"use strict";const e=require("drizzle-orm"),t=require("xgboost_node"),n=require("yahoo-finance2"),r=require("dotenv"),i=require("axios"),a=require("node-fetch");require("./callGrok... L2: CREATE TABLE IF NOT EXISTS ${k.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index-_V1Ql5Es.cjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-_V1Ql5Es.cjs: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-_V1Ql5Es.cjsView on unpkg

1"use strict";const e=require("drizzle-orm"),t=require("xgboost_node"),n=require("yahoo-finance2"),r=require("dotenv"),i=require("axios"),a=require("node-fetch");require("./callGrok... L2: CREATE TABLE IF NOT EXISTS ${k.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index-_V1Ql5Es.cjsView on unpkg · L1

dist/polymarket-updown-15-limit-order-bot-DCC8HE9Z.cjsView file

1"use strict";Object.create,Object.defineProperty,Object.getOwnPropertyDescriptor,Object.getOwnPropertyNames,Object.getPrototypeOf,Object.prototype.hasOwnProperty;const e=require("....

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/polymarket-updown-15-limit-order-bot-DCC8HE9Z.cjsView on unpkg · L1

dist/predictos/data/kalshi.mjsView file

1Trigger-reachable chain: manifest.exports -> dist/predictos/data/kalshi.mjs L1: async function t(t,e={}){const{method:r="GET",headers:n={},params:a={},apiKey:o}=e,s=function(t){const e=t??process.env.DFLOW_API_KEY;if(!e)throw new Error("DFLOW_API_KEY is not co...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/predictos/data/kalshi.mjsView on unpkg · L1

1Trigger-reachable credential exfiltration chain: manifest.exports -> dist/predictos/data/kalshi.mjs L1: async function t(t,e={}){const{method:r="GET",headers:n={},params:a={},apiKey:o}=e,s=function(t){const e=t??process.env.DFLOW_API_KEY;if(!e)throw new Error("DFLOW_API_KEY is not co...

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

dist/predictos/data/kalshi.mjsView on unpkg · L1

dist/index-D7fsk2gy.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-D7fsk2gy.jsView on unpkg

dist/bookmakerAnalysis-CHn1W8uX.cjsView file

•matchType = malicious_source_fingerprint_signature signature = 95f32d165ce29021 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = investing@0.1.76 matchedPath = dist/bookmakerAnalysis-CHn1W8uX.cjs matchedIdentity = npm:aW52ZXN0aW5n:0.1.76 similarity = 1.000 shingleOverlap = 29 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bookmakerAnalysis-CHn1W8uX.cjsView on unpkg

dist/index-CLlAnStL-C554ZmGF.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/index-CLlAnStL-C554ZmGF.js

dist/index-CLlAnStL-C554ZmGF.jsView on unpkg · L1

Source & flagged code

11 flagged

dist/index-CLlAnStL-B7EBGdAY.cjsView file

Lines 1-2javascript

1"use strict";function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){if(Object.prototype.hasOwnProperty.call(e,"__esModule"))return e;var t=e.default;if("function"==typeof t){var n=function e(){var n=!1;try{n=this instanceof e}catch{}return n?Reflect.construct(t,arguments,this.constructor):t.apply(this,arguments)};n.prototype=t.prototype}else n={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.keys(e).forEach(function(t){var s=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,s.get?s:{enumerable:!0,get:funct ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index-CLlAnStL-B7EBGdAY.cjsView on unpkg · L1

2

Long lines were clipped for display.

dist/archiver-web.es-B69gABHP.jsView file

Lines 1-2javascript

1import{c as e,g as t}from"./index-D7fsk2gy.js";function r(e){throw new Error('Could not dynamically require "'+e+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}

dist/index-_V1Ql5Es.cjsView file

1"use strict";const e=require("drizzle-orm"),t=require("xgboost_node"),n=require("yahoo-finance2"),r=require("dotenv"),i=require("axios"),a=require("node-fetch");require("./callGrok... L2: CREATE TABLE IF NOT EXISTS ${k.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index-_V1Ql5Es.cjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-_V1Ql5Es.cjs: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-_V1Ql5Es.cjsView on unpkg

1"use strict";const e=require("drizzle-orm"),t=require("xgboost_node"),n=require("yahoo-finance2"),r=require("dotenv"),i=require("axios"),a=require("node-fetch");require("./callGrok... L2: CREATE TABLE IF NOT EXISTS ${k.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(k`SELECT id, hash, created_at FROM ${k.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

dist/polymarket-updown-15-limit-order-bot-DCC8HE9Z.cjsView file

Lines 1-2javascript

1"use strict";Object.create,Object.defineProperty,Object.getOwnPropertyDescriptor,Object.getOwnPropertyNames,Object.getPrototypeOf,Object.prototype.hasOwnProperty;const e=require("./bookmakerAnalysis-CHn1W8uX.cjs"),t=require("./callGrok-DWO719mN.cjs"),r=require("@polymarket/clob-client"),

dist/predictos/data/kalshi.mjsView file

Lines 1-2javascript

1async function t(t,e={}){const{method:r="GET",headers:n={},params:a={},

dist/index-D7fsk2gy.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-D7fsk2gy.jsView on unpkg

dist/bookmakerAnalysis-CHn1W8uX.cjsView file

•matchType = malicious_source_fingerprint_signature signature = 95f32d165ce29021 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = investing@0.1.76 matchedPath = dist/bookmakerAnalysis-CHn1W8uX.cjs matchedIdentity = npm:aW52ZXN0aW5n:0.1.76 similarity = 1.000 shingleOverlap = 29 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/bookmakerAnalysis-CHn1W8uX.cjsView on unpkg

dist/index-CLlAnStL-C554ZmGF.jsView file

Lines 1-2javascript

1function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){