Loading npm security reports…

invoice-scrape-agent@1.6.3: Malicious npm security report (Block) | LPM Firewall

registry / invoice-scrape-agent / 1.6.3

invoice-scrape-agent@1.6.3

BDB Invoice & Receipt Scraper Suite for headless automation, cross-platform Uber & AliExpress tax invoice fetcher, receipt PNG-to-PDF normalizer, and PDF accounting analyzer

AI Security Review

scanned 2h ago · by lpm-firewall-ai

The package distributes a likely live Uber session credential in services/uber/.env. Installation also modifies the user's Desktop by creating executable shortcuts.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Package download exposes the bundled credential; npm installation runs the lifecycle hooks.

Impact

The credential may permit unauthorized Uber account access, and installation alters user files.

Mechanism

Published session credential and unsolicited install-time Desktop file creation.

Attack narrative

The package includes a large COOKIE value in a published Uber environment file. Its own authentication source shows that this file stores browser session cookies, so distributing it exposes likely account credentials to every recipient. Separately, the lifecycle hooks create executable Desktop shortcuts during installation and can offer to terminate matching background processes. The credential disclosure is a concrete security harm despite the otherwise package-aligned invoice-scraping functions.

Rationale

A bundled session credential is concrete credential exposure, supported by source that collects and persists browser cookies to the same file. The lifecycle hooks add unrequested user-environment changes, reinforcing the need to block publication.

Evidence

services/uber/.envservices/uber/auth.jsutils/shortcut-maker.jsutils/env-check.jspackage.json

Network endpoints3

/invoice-scrape-agent/latest

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node utils/shortcut-maker.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

services/uber/.envView file

1patternName = blocked_file severity = critical matchedText = services/uber/.env redactedSecretContext = secretLikeLines = 1 L1: COOKIE=<redacted:8394 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

index.jsView file

3const inquirer = require('inquirer').default || require('inquirer'); L4: const { execSync } = require('child_process'); L5: const path = require('path');

High

Child Process

Package source references child process execution.

index.jsView on unpkg · L3

388const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L389: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], { L390: detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L388

386console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n"); L387: const cp = require('child_process'); L388: const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================... L389: cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L386

analyzer.jsView file

1const { analyzeInvoices } = require('./services/uber/analyzer'); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

electron/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = invoice-scrape-agent@1.6.2 matchedIdentity = npm:aW52b2ljZS1zY3JhcGUtYWdlbnQ:1.6.2 similarity = 0.930 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.jsView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 1-37json

1{

2 "name": "invoice-scrape-agent",

3 "version": "1.6.3",

4 "description": "BDB Invoice & Receipt Scraper Suite for headless automation, cross-platform Uber & AliExpress tax invoice fetcher, receipt PNG-to-PDF normalizer, and PDF accounting analyzer",

5 "main": "index.js",

6 "bin": {

7 "invoice-scrape-agent": "index.js",

8 "invoice-scrape-agent-gui": "utils/electron-runner.js",

9 "uber-invoice-agent": "index.js",

10 "aliexpress-invoice-agent": "index.js"

11 },

12 "publishConfig": {

13 "access": "public"

14 },

15 "scripts": {

16 "preinstall": "node utils/env-check.js",

17 "postinstall": "node utils/shortcut-maker.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

18 "start": "node index.js",

19 "start:gui": "electron electron/main.js",

20 "setup": "node setup.js",

21 "test": "node --test tests/**/*.test.js",

22 "scaffold": "node services/generator/scaffold.js",

23 "schedule": "node services/scheduler/cron-runner.js",

24 "auth": "node setup.js",

25 "auth:uber": "node services/uber/auth.js",

26 "auth:aliexpress": "node services/aliexpress/auth.js",

27 "auth:amazon": "node services/amazon/auth.js",

28 "scan:uber": "node services/uber/fetcher.js --scan",

29 "scan:aliexpress": "node services/aliexpress/scanner.js",

30 "scan:amazon": "node services/amazon/fetcher.js --scan",

31 "fetch:uber": "node services/uber/fetcher.js",

32 "fetch:aliexpress": "node services/aliexpress/fetcher.js",

33 "fetch:amazon": "node services/amazon/fetcher.js",

34 "analyze": "node index.js",

35 "analyze:uber": "node services/uber/analyzer.js",

36 "analyze:aliexpress": "node services/aliexpress/analyzer.js",

37 "analyze:amazon": "node services/amazon/analyzer.js",

services/uber/.envView file

Lines 1-2text

1COOKIE="_ua={"session_id":"b981e1b0-3e97-4b10-bc89-63f0569e8d51","session_time_ms":1786099194612}; marketing_vistor_id=22e125c3-2fc4-4c55-9c3e-7e6c95586bef; x-uber-analytics-session-id=c7d603e2-3776-4b73-9e84-4c691ddae02d; udi-id=cysh8mz/+y1BxcfNy74/kivmy4TJGYPAqjsaytexwR7TRBwSItZxhrFVnesIPaDffhP1t4YaWlO0ZKKd+lxrqxXZBdBzrkd/y+QuYgg/kly2kJzg1qqYbPAgbiHcNkwXdGREyy84DiswQ1+vdCz9g9Z0h/eUtYEgN0FMrkalU/AxI9TxdyzdMX2pNY95uncFJMbd7Xq81y1W6LsufVDu8A==1gLeYRudZXgR1Qkh1y3cCA==LpW+dWj+8GRvCiQy0gFlxyF8Xjtc0/aDjkr8Sn/pjFQ=; jwt-session=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkYXRhIjp7InNsYXRlLWV4cGlyZXMtYXQ ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

services/uber/.envView on unpkg · L1

2

Long lines were clipped for display.

index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2

3const inquirer = require('inquirer').default || require('inquirer');

4const { execSync } = require(

analyzer.jsView file

Lines 1-8javascript

1const { analyzeInvoices } = require('./services/uber/analyzer');

2

Medium

Dynamic Require

Package source references dynamic require/import behavior.

analyzer.jsView on unpkg · L1

3if (require.main === module) {

4 analyzeInvoices();

assets/set_iconView file

•path = assets/set_icon kind = native_binary sizeBytes = 50600 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

assets/set_iconView on unpkg

install.shView file

•path = install.sh kind = build_helper sizeBytes = 1910 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

electron/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = invoice-scrape-agent@1.6.2 matchedIdentity = npm:aW52b2ljZS1zY3JhcGUtYWdlbnQ:1.6.2 similarity = 0.930 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

electron/main.jsView on unpkg

Lines 366-408javascript

366 console.log('✅ GUI erfolgreich im Hintergrund gestartet!');

367 });

368

369 guiProcess.once('error', (error) => {

370 console.error(`❌ GUI konnte nicht gestartet werden: ${error.message}`);

371 });

372

373 guiProcess.stderr?.once('data', (data) => {

374 if (!launched) console.error(`⚠️ Electron Fehler: ${data.toString().trim()}`);

375 });

376

377 await waitPrompt();

378 } else if (selected === 'update') {

379 console.clear();

380 console.log("======================================================");

381 console.log(" 🔄 Update auf neueste Version wird ausgeführt... ");

382 console.log("======================================================\n");

383

384 const isWin = process.platform === 'win32';

385 if (isWin) {

386 console.log("Windows-Sicherheitssperre: Starte Update in separatem Fenster...\n");

387 const cp = require('child_process');

388 const updateCmd = 'echo ====================================================== & echo BDB Invoice Suite - Auto-Updater & echo ====================================================== & echo. & echo Schliesse alte Prozesse und lade neueste Version... & timeout /t 2 /nobreak >nul & npm install -g invoice-scrape-agent@latest & echo. & echo ====================================================== & echo Update erfolgreich! Druecke ENTER zum Starten. & echo ====================================================== & pause & invoice-scrape-agent';

389 cp.spawn('cmd.exe', ['/c', 'start', 'BDB-Invoice-Updater', 'cmd.exe', '/k', updateCmd], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

index.jsView on unpkg · L386

390 detached: true,

High

Shell

Package source references shell execution.

index.jsView on unpkg · L388

391 stdio: 'ignore'

392 }).unref();

393 console.log("✅ Update-Fenster geöffnet. Diese CLI beendet sich nun sauber.");

394 process.exit(0);

395 } else {

396 try {

397 console.log("Führe 'npm install -g invoice-scrape-agent@latest' aus...\n");

398 execSync('npm install -g invoice-scrape-agent@latest', { stdio: 'inherit' });

399 console.log("\n✅ Update erfolgreich! Bitte starte das Programm neu.");

400 } catch (e) {

401 console.error("\n❌ Fehler beim Update:", e.message);

402 }

403 await waitPrompt();

404 }

405 } else {

406 await handleServiceMenu(selected);

407 }

408 }