invoice-scrape-agent@1.6.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

invoice-scrape-agent@1.6.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node utils/env-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

services/uber/.envView file

1patternName = blocked_file severity = critical matchedText = services/uber/.env redactedSecretContext = secretLikeLines = 1 L1: COOKIE=<redacted:8394 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

index.jsView file

3const inquirer = require('inquirer').default || require('inquirer'); L4: const { execSync } = require('child_process'); L5: const path = require('path');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

383const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L384: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], { L385: detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L383

381console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n"); L382: const cp = require('child_process'); L383: const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L384: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L381

analyzer.jsView file

1const { analyzeInvoices } = require('./services/uber/analyzer'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

electron/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = invoice-scrape-agent@1.5.9 matchedIdentity = npm:aW52b2ljZS1zY3JhcGUtYWdlbnQ:1.5.9 similarity = 0.738 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "invoice-scrape-agent",

3 "version": "1.6.0",

4 "description": "BDB Multi-Service Invoice & Tax Suite: Autonomous, cross-platform Uber & AliExpress tax invoice fetcher, receipt PNG-to-PDF normalizer, and PDF accounting analyzer",

5 "main": "index.js",

6 "bin": {

7 "invoice-scrape-agent": "index.js",

8 "invoice-scrape-agent-gui": "utils/electron-runner.js",

9 "uber-invoice-agent": "index.js",

10 "aliexpress-invoice-agent": "index.js"

11 },

12 "publishConfig": {

13 "access": "public"

14 },

15 "scripts": {

16 "preinstall": "node utils/env-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

17 "postinstall": "node utils/shortcut-maker.js",

18 "start": "node index.js",

19 "start:gui": "electron electron/main.js",

20 "setup": "node setup.js",

21 "test": "node --test tests/**/*.test.js",

22 "scaffold": "node services/generator/scaffold.js",

23 "schedule": "node services/scheduler/cron-runner.js",

24 "auth": "node setup.js",

25 "auth:uber": "node services/uber/auth.js",

26 "auth:aliexpress": "node services/aliexpress/auth.js",

27 "auth:amazon": "node services/amazon/auth.js",

28 "scan:uber": "node services/uber/fetcher.js --scan",

29 "scan:aliexpress": "node services/aliexpress/scanner.js",

30 "scan:amazon": "node services/amazon/fetcher.js --scan",

31 "fetch:uber": "node services/uber/fetcher.js",

32 "fetch:aliexpress": "node services/aliexpress/fetcher.js",

33 "fetch:amazon": "node services/amazon/fetcher.js",

34 "analyze": "node index.js",

35 "analyze:uber": "node services/uber/analyzer.js",

36 "analyze:aliexpress": "node services/aliexpress/analyzer.js",

services/uber/.envView file

Lines 1-2text

1COOKIE="_ua={"session_id":"b981e1b0-3e97-4b10-bc89-63f0569e8d51","session_time_ms":1786099194612}; marketing_vistor_id=22e125c3-2fc4-4c55-9c3e-7e6c95586bef; x-uber-analytics-session-id=c7d603e2-3776-4b73-9e84-4c691ddae02d; udi-id=cysh8mz/+y1BxcfNy74/kivmy4TJGYPAqjsaytexwR7TRBwSItZxhrFVnesIPaDffhP1t4YaWlO0ZKKd+lxrqxXZBdBzrkd/y+QuYgg/kly2kJzg1qqYbPAgbiHcNkwXdGREyy84DiswQ1+vdCz9g9Z0h/eUtYEgN0FMrkalU/AxI9TxdyzdMX2pNY95uncFJMbd7Xq81y1W6LsufVDu8A==1gLeYRudZXgR1Qkh1y3cCA==LpW+dWj+8GRvCiQy0gFlxyF8Xjtc0/aDjkr8Sn/pjFQ=; jwt-session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InNsYXRlLWV4cGlyZXMtYXQ ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

2

Long lines were clipped for display.

index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3const inquirer = require('inquirer').default || require('inquirer');

4const { execSync } = require(

analyzer.jsView file

Lines 1-8javascript

1const { analyzeInvoices } = require('./services/uber/analyzer');

2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

3if (require.main === module) {

4 analyzeInvoices();

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

electron/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = invoice-scrape-agent@1.5.9 matchedIdentity = npm:aW52b2ljZS1zY3JhcGUtYWdlbnQ:1.5.9 similarity = 0.738 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.jsView on unpkg

Lines 361-403javascript

361 console.log('✅ GUI erfolgreich im Hintergrund gestartet!');

362 });

363

364 guiProcess.once('error', (error) => {

365 console.error(`❌ GUI konnte nicht gestartet werden: ${error.message}`);

366 });

367

368 guiProcess.stderr?.once('data', (data) => {

369 if (!launched) console.error(`⚠️ Electron Fehler: ${data.toString().trim()}`);

370 });

371

372 await waitPrompt();

373 } else if (selected === 'update') {

374 console.clear();

375 console.log("======================================================");

376 console.log(" 🔄 Update auf neueste Version wird ausgeführt... ");

377 console.log("======================================================\n");

378

379 const isWin = process.platform === 'win32';

380 if (isWin) {

381 console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n");

382 const cp = require('child_process');

383 const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================== & echo. & echo Schliesse alte Prozesse und lade neueste Version... & timeout /t 2 /nobreak >nul & npm install -g invoice-scrape-agent@latest & echo. & echo ====================================================== & echo Update erfolgreich! Druecke ENTER zum Starten. & echo ====================================================== & pause & invoice-scrape-agent';

384 cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L381

385 detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L383

386 stdio: 'ignore'

387 }).unref();

388 console.log("✅ Update-Fenster geöffnet. Diese CLI beendet sich nun sauber.");

389 process.exit(0);

390 } else {

391 try {

392 console.log("Führe 'npm install -g invoice-scrape-agent@latest' aus...\n");

393 execSync('npm install -g invoice-scrape-agent@latest', { stdio: 'inherit' });

394 console.log("\n✅ Update erfolgreich! Bitte starte das Programm neu.");

395 } catch (e) {

396 console.error("\n❌ Fehler beim Update:", e.message);

397 }

398 await waitPrompt();

399 }

400 } else {

401 await handleServiceMenu(selected);

402 }

403 }