investing@0.1.128: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

investing@0.1.128: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/index-CLlAnStL-B7EBGdAY.cjsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index-CLlAnStL-B7EBGdAY.cjsView on unpkg · L1

dist/archiver-web.es-C0eMJqNQ.jsView file

1import{c as e,g as t}from"./index-CMQXg2Zh.js";function r(e){throw new Error('Could not dynamically require "'+e+'". Please configure the dynamicRequireTargets or/and ignoreDynamic...

High

Eval

Package source references dynamic code evaluation.

dist/archiver-web.es-C0eMJqNQ.jsView on unpkg · L1

dist/index-CMQXg2Zh.jsView file

1import{relations as e,eq as t,and as n,desc as r,asc as i,sql as a,gte as o,lte as s}from"drizzle-orm";import c from"xgboost_node";import l from"yahoo-finance2";import u from"doten... L2: CREATE TABLE IF NOT EXISTS ${Y.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(Y`SELECT id, hash, created_at FROM ${Y.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons... L14: return new Map}const om=mf("greeks");function sm(e){return Math.exp(-.5*e*e)/Math.sqrt(2*Math.PI)}function cm(e){const t=Math.max(1e-4,Math.min(.9999,e)),n=[-39.69683028665376,220.... L15: return new Set}(0,t.cooldownMinutes),i=n.filter(e=>!r.has(e.id));if(0===i.length)return[];const a=[];for(const c of i)c.tokenYes&&a.push(c.tokenYes),c.tokenNo&&a.push

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index-CMQXg2Zh.jsView on unpkg · L1

1import{relations as e,eq as t,and as n,desc as r,asc as i,sql as a,gte as o,lte as s}from"drizzle-orm";import c from"xgboost_node";import l from"yahoo-finance2";import u from"doten... L2: CREATE TABLE IF NOT EXISTS ${Y.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(Y`SELECT id, hash, created_at FROM ${Y.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons... L14: return new Map}const om=mf("greeks");function sm(e){return Math.exp(-.5*e*e)/Math.sqrt(2*Math.PI)}function cm(e){const t=Math.max(1e-4,Math.min(.9999,e)),n=[-39.69683028665376,220.... L15: return new Set}(0,t.cooldownMinutes),i=n.filter(e=>!r.has(e.id));if(0===i.length)return[];const a=[];for(const c of i)c.tokenYes&&a.push(c.tokenYes),c.tokenNo&&a.push

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index-CMQXg2Zh.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/index-CMQXg2Zh.jsView on unpkg

dist/index-DW_NakdK.cjsView file

1Trigger-reachable chain: manifest.main -> dist/index.js -> dist/index-DW_NakdK.cjs L1: "use strict";Object.create,Object.defineProperty,Object.getOwnPropertyDescriptor,Object.getOwnPropertyNames,Object.getPrototypeOf,Object.prototype.hasOwnProperty;const e=require("d... L2: CREATE TABLE IF NOT EXISTS ${x.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(x`SELECT id, hash, created_at FROM ${x.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-DW_NakdK.cjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-DW_NakdK.cjs: `;await t.run(i);const a=(await t.values(x`SELECT id, hash, created_at FROM ${x.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-DW_NakdK.cjsView on unpkg

1Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/index-DW_NakdK.cjs L1: "use strict";Object.create,Object.defineProperty,Object.getOwnPropertyDescriptor,Object.getOwnPropertyNames,Object.getPrototypeOf,Object.prototype.hasOwnProperty;const e=require("d... L2: CREATE TABLE IF NOT EXISTS ${x.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(x`SELECT id, hash, created_at FROM ${x.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

dist/index-CLlAnStL-C554ZmGF.jsView file

1patternName = generic_password severity = medium line = 1

Medium

Secret Pattern

Hardcoded password in dist/index-CLlAnStL-C554ZmGF.js

dist/index-CLlAnStL-C554ZmGF.jsView on unpkg · L1

Source & flagged code

9 flagged

dist/index-CLlAnStL-B7EBGdAY.cjsView file

Lines 1-2javascript

1"use strict";function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){if(Object.prototype.hasOwnProperty.call(e,"__esModule"))return e;var t=e.default;if("function"==typeof t){var n=function e(){var n=!1;try{n=this instanceof e}catch{}return n?Reflect.construct(t,arguments,this.constructor):t.apply(this,arguments)};n.prototype=t.prototype}else n={};return Object.defineProperty(n,"__esModule",{value:!0}),Object.keys(e).forEach(function(t){var s=Object.getOwnPropertyDescriptor(e,t);Object.defineProperty(n,t,s.get?s:{enumerable:!0,get:funct ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index-CLlAnStL-B7EBGdAY.cjsView on unpkg · L1

2

Long lines were clipped for display.

dist/archiver-web.es-C0eMJqNQ.jsView file

Lines 1-2javascript

1import{c as e,g as t}from"./index-CMQXg2Zh.js";function r(e){throw new Error('Could not dynamically require "'+e+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}

dist/index-CMQXg2Zh.jsView file

1import{relations as e,eq as t,and as n,desc as r,asc as i,sql as a,gte as o,lte as s}from"drizzle-orm";import c from"xgboost_node";import l from"yahoo-finance2";import u from"doten... L2: CREATE TABLE IF NOT EXISTS ${Y.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(Y`SELECT id, hash, created_at FROM ${Y.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons... L14: return new Map}const om=mf("greeks");function sm(e){return Math.exp(-.5*e*e)/Math.sqrt(2*Math.PI)}function cm(e){const t=Math.max(1e-4,Math.min(.9999,e)),n=[-39.69683028665376,220.... L15: return new Set}(0,t.cooldownMinutes),i=n.filter(e=>!r.has(e.id));if(0===i.length)return[];const a=[];for(const c of i)c.tokenYes&&a.push(c.tokenYes),c.tokenNo&&a.push

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index-CMQXg2Zh.jsView on unpkg · L1

1import{relations as e,eq as t,and as n,desc as r,asc as i,sql as a,gte as o,lte as s}from"drizzle-orm";import c from"xgboost_node";import l from"yahoo-finance2";import u from"doten... L2: CREATE TABLE IF NOT EXISTS ${Y.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(Y`SELECT id, hash, created_at FROM ${Y.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons... L14: return new Map}const om=mf("greeks");function sm(e){return Math.exp(-.5*e*e)/Math.sqrt(2*Math.PI)}function cm(e){const t=Math.max(1e-4,Math.min(.9999,e)),n=[-39.69683028665376,220.... L15: return new Set}(0,t.cooldownMinutes),i=n.filter(e=>!r.has(e.id));if(0===i.length)return[];const a=[];for(const c of i)c.tokenYes&&a.push(c.tokenYes),c.tokenNo&&a.push

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index-CMQXg2Zh.jsView on unpkg · L1

dist/index-DW_NakdK.cjsView file

1Trigger-reachable chain: manifest.main -> dist/index.js -> dist/index-DW_NakdK.cjs L1: "use strict";Object.create,Object.defineProperty,Object.getOwnPropertyDescriptor,Object.getOwnPropertyNames,Object.getPrototypeOf,Object.prototype.hasOwnProperty;const e=require("d... L2: CREATE TABLE IF NOT EXISTS ${x.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(x`SELECT id, hash, created_at FROM ${x.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index-DW_NakdK.cjsView on unpkg · L1

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index-DW_NakdK.cjs: `;await t.run(i);const a=(await t.values(x`SELECT id, hash, created_at FROM ${x.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index-DW_NakdK.cjsView on unpkg

1Trigger-reachable credential exfiltration chain: manifest.main -> dist/index.js -> dist/index-DW_NakdK.cjs L1: "use strict";Object.create,Object.defineProperty,Object.getOwnPropertyDescriptor,Object.getOwnPropertyNames,Object.getPrototypeOf,Object.prototype.hasOwnProperty;const e=require("d... L2: CREATE TABLE IF NOT EXISTS ${x.identifier(r)} ( ... L12: ) L13: `;await t.run(i);const a=(await t.values(x`SELECT id, hash, created_at FROM ${x.identifier(r)} ORDER BY created_at DESC LIMIT 1`))[0]??void 0;await t.transaction(async t=>{for(cons...

dist/index-CLlAnStL-C554ZmGF.jsView file

Lines 1-2javascript

1function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e){