iobend: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

iobend: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "import('./src/services/agentDaemon.js').then(m=>m.installAgentDaemon({silent:true})).catch(()=>{})"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "import('./src/services/agentDaemon.js').then(m=>m.installAgentDaemon({silent:true})).catch(()=>{})"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

src/commands/dotfiles/index.jsView file

5L6: const DOTFILES_DIR = path.join(os.homedir(), '.iobend', 'dotfiles'); L7: const TARGET_FILES = ['.zshrc', '.bashrc', '.gitconfig', '.vimrc', '.tmux.conf']; L8:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/commands/dotfiles/index.jsView on unpkg · L5

src/commands/verify/index.jsView file

10const token = await getGlobalConfig('token'); L11: const apiBase = (await getGlobalConfig('apiUrl')) || 'https://iobend.com'; L12: ... L23: if (res.ok) { L24: const data = await res.json(); L25: if (data.success) {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

src/commands/verify/index.jsView on unpkg · L10

src/commands/scan/index.jsView file

4import path from 'path'; L5: import { execa } from 'execa'; L6: import { getGlobalConfig, loadLocalProject } from '../../utils/config.js'; ... L21: try { L22: const cwd = process.cwd(); L23: ... L49: for (const file of allFiles) { L50: if (file.endsWith('package.json')) { L51: try { L52: const pkg = JSON.parse(fs.readFileSync(file, 'utf8')); L53: const allDeps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) }; ... L136: // Run npm audit --json. It exits with 1 if vulns are found, so reject: false is critical.

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

src/commands/scan/index.jsView on unpkg · L4

4Trigger-reachable credential exfiltration chain: scripts.start -> src/index.js -> src/commands/scan/index.js L4: import path from 'path'; L5: import { execa } from 'execa'; L6: import { getGlobalConfig, loadLocalProject } from '../../utils/config.js'; ... L21: try { L22: const cwd = process.cwd(); L23: ... L49: for (const file of allFiles) { L50: if (file.endsWith('package.json')) { L51: try { L52: const pkg = JSON.parse(fs.readFileSync(file, 'utf8')); L53: const allDeps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) }; ... L136: // Run npm audit --json. It exits with 1 if vulns are found, so reject: false is critical.

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/commands/scan/index.jsView on unpkg · L4

src/commands/info/index.jsView file

11Trigger-reachable chain: scripts.start -> src/index.js -> src/commands/info/index.js L11: const token = await getGlobalConfig('token'); L12: const apiBase = (await getGlobalConfig('apiUrl')) || 'https://iobend.com'; L13: ... L19: if (res.ok) { L20: const data = await res.json(); L21: if (data.success) { ... L51: console.log(); L52: console.log(result.stdout); L53: } catch (error) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

src/commands/info/index.jsView on unpkg · L11

src/commands/completion/index.jsView file

10Trigger-reachable persistence chain: scripts.start -> src/index.js -> src/commands/completion/index.js L10: if (!shell || shell === 'bash') { L11: const userShell = process.env.SHELL || ''; L12: if (userShell.includes('zsh')) shell = 'zsh'; L13: else if (userShell.includes('fish')) shell = 'fish'; L14: else if (process.platform === 'win32' && !process.env.SHELL) shell = 'powershell'; L15: else shell = shell || 'bash'; ... L177: try { L178: const homeDir = os.homedir(); L179: let targetProfile = ''; ... L181: if (shell === 'zsh') { L182: targetProfile = path.join(homeDir, '.zshrc'); L183: } else if (shell === 'fish') {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

src/commands/completion/index.jsView on unpkg · L10

src/utils/send-toast.ps1View file

•path = src/utils/send-toast.ps1 kind = build_helper sizeBytes = 1467 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/utils/send-toast.ps1View on unpkg

src/commands/agent/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = iobend@2.6.1 matchedIdentity = npm:aW9iZW5k:2.6.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/agent/index.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 12-52json

12 },

13 "author": "IOBend",

14 "license": "MIT",

15 "type": "module",

16 "files": [

17 "src"

18 ],

19 "bin": {

20 "iobend": "src/index.js"

21 },

22 "engines": {

23 "node": ">=20.0.0"

24 },

25 "publishConfig": {

26 "access": "public"

27 },

28 "scripts": {

29 "start": "node src/index.js",

30 "dev": "node src/index.js",

31 "build": "node build.js",

32 "postinstall": "node -e \"import('./src/services/agentDaemon.js').then(m=>m.installAgentDaemon({silent:true})).catch(()=>{})\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L32

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L32

33 "test": "vitest run"

34 },

35 "keywords": [

36 "cli",

37 "developer-experience",

38 "unified-platform",

39 "developer",

40 "automation",

41 "setup"

42 ],

43 "dependencies": {

44 "@inquirer/prompts": "^8.5.2",

45 "chalk": "^5.6.2",

46 "commander": "^15.0.0",

47 "execa": "^9.6.1",

48 "express": "^5.2.1",

49 "kill-port": "^2.0.1",

50 "node-notifier": "^10.0.1",

51 "omelette": "^0.4.17",

52 "open": "^11.0.0",

src/commands/dotfiles/index.jsView file

Lines 1-25javascript

1import fs from 'fs/promises';

2import path from 'path';

3import os from 'os';

4import { logger, isJsonMode, printJson } from '../../utils/logger.js';

src/commands/verify/index.jsView file

Lines 1-30javascript

1import { logger } from '../../utils/logger.js';

2import { getGlobalConfig } from '../../utils/config.js';

3

4export async function verifyCommand(tool) {

5

src/commands/scan/index.jsView file

Lines 1-24javascript

1import chalk from 'chalk';

2import ora from 'ora';

3import fs from 'fs';

4import path from 'path';

src/commands/info/index.jsView file

Lines 1-31javascript

1import { getToolInfo } from '../../installers/index.js';

2import { logger } from '../../utils/logger.js';

3import { getGlobalConfig } from '../../utils/config.js';

4

5export async

src/commands/completion/index.jsView file

Lines 1-30javascript

1import fs from 'fs';

2import path from 'path';

3import os from 'os';

4import { logger, isJsonMode, printJson } from '../../utils/logger.js';

src/utils/send-toast.ps1View file

•path = src/utils/send-toast.ps1 kind = build_helper sizeBytes = 1467 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/utils/send-toast.ps1View on unpkg

src/commands/agent/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = iobend@2.6.1 matchedIdentity = npm:aW9iZW5k:2.6.1 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/agent/index.jsView on unpkg