invoice-scrape-agent@1.6.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

invoice-scrape-agent@1.6.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node utils/env-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

services/uber/.envView file

1patternName = blocked_file severity = critical matchedText = services/uber/.env redactedSecretContext = secretLikeLines = 1 L1: COOKIE=<redacted:8394 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

index.jsView file

3const inquirer = require('inquirer').default || require('inquirer'); L4: const { execSync } = require('child_process'); L5: const path = require('path');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

387const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L388: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], { L389: detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L387

385console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n"); L386: const cp = require('child_process'); L387: const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L388: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L385

analyzer.jsView file

1const { analyzeInvoices } = require('./services/uber/analyzer'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

services/uber/fetcher.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = invoice-scrape-agent@1.6.1 matchedIdentity = npm:aW52b2ljZS1zY3JhcGUtYWdlbnQ:1.6.1 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

services/uber/fetcher.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "invoice-scrape-agent",

3 "version": "1.6.2",

4 "description": "BDB Invoice & Receipt Scraper Suite for headless automation, cross-platform Uber & AliExpress tax invoice fetcher, receipt PNG-to-PDF normalizer, and PDF accounting analyzer",

5 "main": "index.js",

6 "bin": {

7 "invoice-scrape-agent": "index.js",

8 "invoice-scrape-agent-gui": "utils/electron-runner.js",

9 "uber-invoice-agent": "index.js",

10 "aliexpress-invoice-agent": "index.js"

11 },

12 "publishConfig": {

13 "access": "public"

14 },

15 "scripts": {

16 "preinstall": "node utils/env-check.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

17 "postinstall": "node utils/shortcut-maker.js",

18 "start": "node index.js",

19 "start:gui": "electron electron/main.js",

20 "setup": "node setup.js",

21 "test": "node --test tests/**/*.test.js",

22 "scaffold": "node services/generator/scaffold.js",

23 "schedule": "node services/scheduler/cron-runner.js",

24 "auth": "node setup.js",

25 "auth:uber": "node services/uber/auth.js",

26 "auth:aliexpress": "node services/aliexpress/auth.js",

27 "auth:amazon": "node services/amazon/auth.js",

28 "scan:uber": "node services/uber/fetcher.js --scan",

29 "scan:aliexpress": "node services/aliexpress/scanner.js",

30 "scan:amazon": "node services/amazon/fetcher.js --scan",

31 "fetch:uber": "node services/uber/fetcher.js",

32 "fetch:aliexpress": "node services/aliexpress/fetcher.js",

33 "fetch:amazon": "node services/amazon/fetcher.js",

34 "analyze": "node index.js",

35 "analyze:uber": "node services/uber/analyzer.js",

36 "analyze:aliexpress": "node services/aliexpress/analyzer.js",

services/uber/.envView file

Lines 1-2text

1COOKIE="_ua={"session_id":"b981e1b0-3e97-4b10-bc89-63f0569e8d51","session_time_ms":1786099194612}; marketing_vistor_id=22e125c3-2fc4-4c55-9c3e-7e6c95586bef; x-uber-analytics-session-id=c7d603e2-3776-4b73-9e84-4c691ddae02d; udi-id=cysh8mz/+y1BxcfNy74/kivmy4TJGYPAqjsaytexwR7TRBwSItZxhrFVnesIPaDffhP1t4YaWlO0ZKKd+lxrqxXZBdBzrkd/y+QuYgg/kly2kJzg1qqYbPAgbiHcNkwXdGREyy84DiswQ1+vdCz9g9Z0h/eUtYEgN0FMrkalU/AxI9TxdyzdMX2pNY95uncFJMbd7Xq81y1W6LsufVDu8A==1gLeYRudZXgR1Qkh1y3cCA==LpW+dWj+8GRvCiQy0gFlxyF8Xjtc0/aDjkr8Sn/pjFQ=; jwt-session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InNsYXRlLWV4cGlyZXMtYXQ ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

2

Long lines were clipped for display.

index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3const inquirer = require('inquirer').default || require('inquirer');

4const { execSync } = require(

analyzer.jsView file

Lines 1-8javascript

1const { analyzeInvoices } = require('./services/uber/analyzer');

2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

3if (require.main === module) {

4 analyzeInvoices();

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

services/uber/fetcher.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = invoice-scrape-agent@1.6.1 matchedIdentity = npm:aW52b2ljZS1zY3JhcGUtYWdlbnQ:1.6.1 similarity = 0.953 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

services/uber/fetcher.jsView on unpkg

Lines 365-407javascript

365 console.log('✅ GUI erfolgreich im Hintergrund gestartet!');

366 });

367

368 guiProcess.once('error', (error) => {

369 console.error(`❌ GUI konnte nicht gestartet werden: ${error.message}`);

370 });

371

372 guiProcess.stderr?.once('data', (data) => {

373 if (!launched) console.error(`⚠️ Electron Fehler: ${data.toString().trim()}`);

374 });

375

376 await waitPrompt();

377 } else if (selected === 'update') {

378 console.clear();

379 console.log("======================================================");

380 console.log(" 🔄 Update auf neueste Version wird ausgeführt... ");

381 console.log("======================================================\n");

382

383 const isWin = process.platform === 'win32';

384 if (isWin) {

385 console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n");

386 const cp = require('child_process');

387 const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================== & echo. & echo Schliesse alte Prozesse und lade neueste Version... & timeout /t 2 /nobreak >nul & npm install -g invoice-scrape-agent@latest & echo. & echo ====================================================== & echo Update erfolgreich! Druecke ENTER zum Starten. & echo ====================================================== & pause & invoice-scrape-agent';

388 cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L385

389 detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L387

390 stdio: 'ignore'

391 }).unref();

392 console.log("✅ Update-Fenster geöffnet. Diese CLI beendet sich nun sauber.");

393 process.exit(0);

394 } else {

395 try {

396 console.log("Führe 'npm install -g invoice-scrape-agent@latest' aus...\n");

397 execSync('npm install -g invoice-scrape-agent@latest', { stdio: 'inherit' });

398 console.log("\n✅ Update erfolgreich! Bitte starte das Programm neu.");

399 } catch (e) {

400 console.error("\n❌ Fehler beim Update:", e.message);

401 }

402 await waitPrompt();

403 }

404 } else {

405 await handleServiceMenu(selected);

406 }

407 }