invoice-scrape-agent@1.5.9: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

invoice-scrape-agent@1.5.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node utils/shortcut-maker.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

services/uber/.envView file

1patternName = blocked_file severity = critical matchedText = services/uber/.env redactedSecretContext = secretLikeLines = 1 L1: COOKIE=<redacted:8394 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

index.jsView file

3const inquirer = require('inquirer').default || require('inquirer'); L4: const { execSync } = require('child_process'); L5: const path = require('path');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

377const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L378: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], { L379: detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L377

375console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n"); L376: const cp = require('child_process'); L377: const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L378: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L375

analyzer.jsView file

1const { analyzeInvoices } = require('./services/uber/analyzer'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "invoice-scrape-agent",

3 "version": "1.5.9",

4 "description": "BDB Multi-Service Invoice & Tax Suite: Autonomous, cross-platform Uber & AliExpress tax invoice fetcher, receipt PNG-to-PDF normalizer, and PDF accounting analyzer",

5 "main": "index.js",

6 "bin": {

7 "invoice-scrape-agent": "index.js",

8 "invoice-scrape-agent-gui": "utils/electron-runner.js",

9 "uber-invoice-agent": "index.js",

10 "aliexpress-invoice-agent": "index.js"

11 },

12 "publishConfig": {

13 "access": "public"

14 },

15 "scripts": {

16 "preinstall": "node utils/env-check.js",

17 "postinstall": "node utils/shortcut-maker.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 "start": "node index.js",

19 "start:gui": "electron electron/main.js",

20 "setup": "node setup.js",

21 "test": "node --test tests/**/*.test.js",

22 "scaffold": "node services/generator/scaffold.js",

23 "schedule": "node services/scheduler/cron-runner.js",

24 "auth": "node setup.js",

25 "auth:uber": "node services/uber/auth.js",

26 "auth:aliexpress": "node services/aliexpress/auth.js",

27 "auth:amazon": "node services/amazon/auth.js",

28 "scan:uber": "node services/uber/fetcher.js --scan",

29 "scan:aliexpress": "node services/aliexpress/scanner.js",

30 "scan:amazon": "node services/amazon/fetcher.js --scan",

31 "fetch:uber": "node services/uber/fetcher.js",

32 "fetch:aliexpress": "node services/aliexpress/fetcher.js",

33 "fetch:amazon": "node services/amazon/fetcher.js",

34 "analyze": "node index.js",

35 "analyze:uber": "node services/uber/analyzer.js",

36 "analyze:aliexpress": "node services/aliexpress/analyzer.js",

37 "analyze:amazon": "node services/amazon/analyzer.js",

services/uber/.envView file

Lines 1-2text

1COOKIE="_ua={"session_id":"b981e1b0-3e97-4b10-bc89-63f0569e8d51","session_time_ms":1786099194612}; marketing_vistor_id=22e125c3-2fc4-4c55-9c3e-7e6c95586bef; x-uber-analytics-session-id=c7d603e2-3776-4b73-9e84-4c691ddae02d; udi-id=cysh8mz/+y1BxcfNy74/kivmy4TJGYPAqjsaytexwR7TRBwSItZxhrFVnesIPaDffhP1t4YaWlO0ZKKd+lxrqxXZBdBzrkd/y+QuYgg/kly2kJzg1qqYbPAgbiHcNkwXdGREyy84DiswQ1+vdCz9g9Z0h/eUtYEgN0FMrkalU/AxI9TxdyzdMX2pNY95uncFJMbd7Xq81y1W6LsufVDu8A==1gLeYRudZXgR1Qkh1y3cCA==LpW+dWj+8GRvCiQy0gFlxyF8Xjtc0/aDjkr8Sn/pjFQ=; jwt-session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InNsYXRlLWV4cGlyZXMtYXQ ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

2

Long lines were clipped for display.

index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3const inquirer = require('inquirer').default || require('inquirer');

4const { execSync } = require(

analyzer.jsView file

Lines 1-8javascript

1const { analyzeInvoices } = require('./services/uber/analyzer');

2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

3if (require.main === module) {

4 analyzeInvoices();

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Lines 355-397javascript

355 console.log('✅ GUI erfolgreich im Hintergrund gestartet!');

356 });

357

358 guiProcess.once('error', (error) => {

359 console.error(`❌ GUI konnte nicht gestartet werden: ${error.message}`);

360 });

361

362 guiProcess.stderr?.once('data', (data) => {

363 if (!launched) console.error(`⚠️ Electron Fehler: ${data.toString().trim()}`);

364 });

365

366 await waitPrompt();

367 } else if (selected === 'update') {

368 console.clear();

369 console.log("======================================================");

370 console.log(" 🔄 Update auf neueste Version wird ausgeführt... ");

371 console.log("======================================================\n");

372

373 const isWin = process.platform === 'win32';

374 if (isWin) {

375 console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n");

376 const cp = require('child_process');

377 const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================== & echo. & echo Schliesse alte Prozesse und lade neueste Version... & timeout /t 2 /nobreak >nul & npm install -g invoice-scrape-agent@latest & echo. & echo ====================================================== & echo Update erfolgreich! Druecke ENTER zum Starten. & echo ====================================================== & pause & invoice-scrape-agent';

378 cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L375

379 detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L377

380 stdio: 'ignore'

381 }).unref();

382 console.log("✅ Update-Fenster geöffnet. Diese CLI beendet sich nun sauber.");

383 process.exit(0);

384 } else {

385 try {

386 console.log("Führe 'npm install -g invoice-scrape-agent@latest' aus...\n");

387 execSync('npm install -g invoice-scrape-agent@latest', { stdio: 'inherit' });

388 console.log("\n✅ Update erfolgreich! Bitte starte das Programm neu.");

389 } catch (e) {

390 console.error("\n❌ Fehler beim Update:", e.message);

391 }

392 await waitPrompt();

393 }

394 } else {

395 await handleServiceMenu(selected);

396 }

397 }