kurumi-fca@1.1.9: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

kurumi-fca@1.1.9: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged · loading source

checkUpdate.jsView file

1const axios = require('axios'); L2: const { execSync } = require('child_process'); L3: const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

89console.log('\x1b[36m%s\x1b[0m', `📦 Running npm install kurumi-fca@${version}...`); L90: execSync(`npm install kurumi-fca@${version} --save`, { cwd: process.cwd(), stdio: 'inherit' }); L91: console.log('\x1b[32m%s\x1b[0m', '✅ Package installed successfully!');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

checkUpdate.jsView on unpkg · L89

1const axios = require('axios'); L2: const { execSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

checkUpdate.jsView on unpkg · L1

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = fca-nx@1.8.0 matchedPath = src/getAccess.js matchedIdentity = npm:ZmNhLW54:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

index.jsView file

329return new Promise((resolve, reject) => { request.post( { url: 'https://api.imgbb.com/1/upload', qs: { expiration, key: _imgKeys.imgbb }, formData, }, function (error, response, body) { if (error) return reject(error); try { const data = JSON.parse(body); if (!data || !data.success) return reject(data || new Error('ImgBB upload failed')); resolve(data);

High

Ai Review Evidence

The uploader silently posts supplied photo data/URLs to ImgBB and may fall back to ImageKit.

index.jsView on unpkg · L329

Source & flagged code

5 flagged

checkUpdate.jsView file

Lines 1-21javascript

1const axios = require('axios');

2const { execSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

checkUpdate.jsView on unpkg · L1

3const fs = require('fs');

High

Child Process

Package source references child process execution.

checkUpdate.jsView on unpkg · L1

4const path = require('path');

5

6function getCurrentVersion() {

7 // 1. If this file is inside the kurumi-fca package itself (development mode)

8 try {

9 const ownPkg = path.join(__dirname, 'package.json');

10 if (fs.existsSync(ownPkg)) {

11 const pkg = JSON.parse(fs.readFileSync(ownPkg, 'utf-8'));

12 if (pkg.name === 'kurumi-fca' && pkg.version) return pkg.version;

13 }

14 } catch (_) { }

15

16 // 2. Installed as dependency in a user's project

17 try {

18 const nodeModulesPkg = path.join(process.cwd(), 'node_modules', 'kurumi-fca', 'package.json');

19 if (fs.existsSync(nodeModulesPkg)) {

20 const pkg = JSON.parse(fs.readFileSync(nodeModulesPkg, 'utf-8'));

21 if (pkg.version) return pkg.version;

Lines 69-109javascript

69 }

70 } catch (error) {

71 console.log('\x1b[31m%s\x1b[0m', '❌ Failed to check for kurumi-fca updates:', error.message);

72 return false;

73 }

74}

75

76

src/getAccess.jsView file

•matchType = normalized_sha256 matchedPackage = fca-nx@1.8.0 matchedPath = src/getAccess.js matchedIdentity = npm:ZmNhLW54:1.8.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/getAccess.jsView on unpkg

index.jsView file

Lines 309-349javascript

309 if (d && d.img1 && d.img1.public_key) _imgKeys.ik_pub = d.img1.public_key;

310 if (d && d.img1 && d.img1.private_key) _imgKeys.ik_priv = d.img1.private_key;

311 } catch (_) { }

312 })();

313