Loading npm security reports…

itrm-tools@1.3.46: Clean npm security report (Allow) | LPM Firewall

registry / itrm-tools / 1.3.46

itrm-tools@1.3.46

Library design for developing API Services

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Network and encrypted-environment helpers are explicit library APIs using caller-provided endpoints and keys.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Caller explicitly invokes decodeEnvFile, requestSecretKey, logging, or API client methods.

Impact

No install-time, import-time, persistence, exfiltration, destructive, or remote-payload behavior found.

Mechanism

Caller-configured HTTP/WebSocket and local encrypted-env utility APIs.

Rationale

The scanner-highlighted environment helper is an explicit utility that decrypts only the current project's .env.enc and contacts a caller-provided service URL. Direct inspection found no automatic execution, broad harvesting, endpoint hard-coding for exfiltration, or mutation behavior.

Evidence

package.jsondist/index.jsdist/env/EnvDecryption.jsdist/api/request/RequestAxiosCall.jsdist/log/Logger.jsdist/api/APIService.jsdist/web3/coingecko/CoingeckoPriceFinder.js.env.enc

Decision evidence

public snapshot

AI called this Clean at 97.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall, install, or postinstall hooks.
dist/index.js only re-exports library APIs; no startup invocation is present.
dist/env/EnvDecryption.js reads only cwd/.env.enc when decodeEnvFile is explicitly called.
dist/env/EnvDecryption.js sends a request only to the caller-supplied secretKeyServiceUrl.
No child-process, shell, eval/vm, filesystem-write, or AI-agent-control code was found in dist/*.js.
The declared https dependency is not imported by package source.

Behavioral surface

Source

FilesystemNetworkWebSocket

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 83 file(s), 185 KB of source, external domains: api.coingecko.com

Source & flagged code

2 flagged

package.jsonView file

Lines 1-30json

2 "name": "itrm-tools",

3 "version": "1.3.46",

4 "description": "",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "files": [

8 "/dist"

9 ],

10 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L10

11 "build": "rimraf ./dist && tsc --skipLibCheck",

12 "publish-lib": "npm run build && npm publish",

13 "publish-beta": "npm run build && npm publish --tag beta",

14 "publish-dryrun": "npm run build && npm publish --dry-run",

15 "link": "npm run build && npm link",

16 "test": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles",

17 "test-silent": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent",

18 "test-watch": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

19 "test-watch-start": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

20 "test-coverage": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent --coverage"

21 },

22 "repository": {

23 "type": "git",

24 "url": "git+https://github.com/ITRMachines/itrm-tools.git"

25 },

26 "keywords": [],

27 "author": "",

28 "license": "ISC",

29 "bugs": {

30 "url": "https://github.com/ITRMachines/itrm-tools/issues"

dist/env/EnvDecryption.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = itrm-tools@1.3.46-beta matchedIdentity = npm:aXRybS10b29scw:1.3.46-beta similarity = 0.988 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/env/EnvDecryption.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•Runtime dependency names matching Node built-ins: https

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/env/EnvDecryption.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/env/EnvDecryption.jsView on unpkg

Findings

2 High1 Medium3 Low

HighNode Builtin Dependency Squatpackage.json

HighPrevious Version Dangerous Deltadist/env/EnvDecryption.js

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

package.jsonView file

Lines 1-30json

2 "name": "itrm-tools",

3 "version": "1.3.46",

4 "description": "",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "files": [

8 "/dist"

9 ],

10 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L10

11 "build": "rimraf ./dist && tsc --skipLibCheck",

12 "publish-lib": "npm run build && npm publish",

13 "publish-beta": "npm run build && npm publish --tag beta",

14 "publish-dryrun": "npm run build && npm publish --dry-run",

15 "link": "npm run build && npm link",

16 "test": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles",

17 "test-silent": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent",

18 "test-watch": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

19 "test-watch-start": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

20 "test-coverage": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent --coverage"

21 },

22 "repository": {

23 "type": "git",

24 "url": "git+https://github.com/ITRMachines/itrm-tools.git"

25 },

26 "keywords": [],

27 "author": "",

28 "license": "ISC",

29 "bugs": {

30 "url": "https://github.com/ITRMachines/itrm-tools/issues"

dist/env/EnvDecryption.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/env/EnvDecryption.jsView on unpkg