Loading npm security reports…

itrm-tools@1.3.47: Clean npm security report (Allow) | LPM Firewall

registry / itrm-tools / 1.3.47

itrm-tools@1.3.47

Library design for developing API Services

AI Security Review

scanned 3d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package exposes opt-in environment encryption and user-configured HTTP/WebSocket client helpers, without install-time execution or embedded exfiltration targets.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User invokes `encrypt-env <SECRET_KEY>` or calls exported networking helpers.

Impact

The CLI reads `.env` and writes encrypted `.env.enc` in the current project; no unconsented collection, execution, or persistence was found.

Mechanism

User-invoked local `.env` encryption and caller-configured API requests.

Rationale

Direct source inspection shows a library with explicit encryption and networking utilities, not an install-time or stealth execution chain. The scanner signals are explained by legitimate API, cryptography, and local environment-file functionality.

Evidence

package.jsonbin/encrypt-env.jsdist/env/EnvDecryption.jsdist/api/request/RequestAxiosCall.jsdist/api/request/crud/common/ServiceSessionManager.jsdist/web3/coingecko/CoingeckoPriceFinder.jsdist/api/HttpsAPIService.js.env.env.enc

Network endpoints1

api.coingecko.com/api/v3/coins/

Decision evidence

public snapshot

AI called this Clean at 95.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/env/EnvDecryption.js` can read `.env` and write `.env.enc`, but only through exported functions or the explicit `encrypt-env` CLI.
`requestSecretKey` performs a GET only to a caller-supplied service URL; no package-owned collection endpoint is embedded.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` lifecycle hook.
`bin/encrypt-env.js` requires a user-supplied key and explicitly invokes local environment-file encryption.
`dist/env/EnvDecryption.js` has no import-time file or network operation; it only defines exported helpers.
No child-process, shell, eval/vm, dynamic remote loading, AI-agent control-path, or persistence primitives were found in `dist` or `bin`.
`dist/web3/coingecko/CoingeckoPriceFinder.js` contacts CoinGecko only when its price lookup method is called.
`dist/api/HttpsAPIService.js` uses `https.createServer` for a local HTTPS server; the declared `https` dependency is not used as a remote payload.

Behavioral surface

Source

FilesystemNetworkWebSocket

Source & flagged code

2 flagged

package.jsonView file

Lines 1-34json

2 "name": "itrm-tools",

3 "version": "1.3.47",

4 "description": "",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "encrypt-env": "bin/encrypt-env.js"

9 },

10 "files": [

11 "/dist",

12 "/bin"

13 ],

14 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L14

15 "build": "rimraf ./dist && tsc --skipLibCheck",

16 "publish-lib": "npm run build && npm publish",

17 "publish-beta": "npm run build && npm publish --tag beta",

18 "publish-dryrun": "npm run build && npm publish --dry-run",

19 "link": "npm run build && npm link",

20 "test": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles",

21 "test-silent": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent",

22 "test-watch": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

23 "test-watch-start": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

24 "test-coverage": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent --coverage"

25 },

26 "repository": {

27 "type": "git",

28 "url": "git+https://github.com/ITRMachines/itrm-tools.git"

29 },

30 "keywords": [],

31 "author": "",

32 "license": "ISC",

33 "bugs": {

34 "url": "https://github.com/ITRMachines/itrm-tools/issues"

dist/env/EnvDecryption.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = itrm-tools@1.3.46 matchedIdentity = npm:aXRybS10b29scw:1.3.46 similarity = 0.976 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/env/EnvDecryption.jsView on unpkg

Source & flagged code

2 flagged · loading source

package.jsonView file

•Runtime dependency names matching Node built-ins: https

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/env/EnvDecryption.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/env/EnvDecryption.jsView on unpkg

Findings

2 High1 Medium3 Low

HighNode Builtin Dependency Squatpackage.json

HighPrevious Version Dangerous Deltadist/env/EnvDecryption.js

MediumNetwork

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

package.jsonView file

Lines 1-34json

2 "name": "itrm-tools",

3 "version": "1.3.47",

4 "description": "",

5 "main": "dist/index.js",

6 "types": "dist/index.d.ts",

7 "bin": {

8 "encrypt-env": "bin/encrypt-env.js"

9 },

10 "files": [

11 "/dist",

12 "/bin"

13 ],

14 "scripts": {

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg · L14

15 "build": "rimraf ./dist && tsc --skipLibCheck",

16 "publish-lib": "npm run build && npm publish",

17 "publish-beta": "npm run build && npm publish --tag beta",

18 "publish-dryrun": "npm run build && npm publish --dry-run",

19 "link": "npm run build && npm link",

20 "test": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles",

21 "test-silent": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent",

22 "test-watch": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

23 "test-watch-start": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --watch --runInBand --detectOpenHandles",

24 "test-coverage": "npm run build && set NODE_OPTIONS=--experimental-vm-modules && jest --runInBand --detectOpenHandles --silent --coverage"

25 },

26 "repository": {

27 "type": "git",

28 "url": "git+https://github.com/ITRMachines/itrm-tools.git"

29 },

30 "keywords": [],

31 "author": "",

32 "license": "ISC",

33 "bugs": {

34 "url": "https://github.com/ITRMachines/itrm-tools/issues"

dist/env/EnvDecryption.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/env/EnvDecryption.jsView on unpkg