mobbdev@1.4.57: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

mobbdev@1.4.57: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./src/post_install/cx_install.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4patternName = blocked_file severity = critical matchedText = .env redactedSecretContext = secretLikeLines = 5 L4: GITLAB_API_TOKEN=<redacted:0 empty> L5: GITHUB_API_TOKEN=<redacted:0 empty> L6: ADO_TEST_ACCESS_TOKEN=<redacted:0 empty> L7: HASURA_ACCESS_KEY=<redacted:0 empty> L10: DD_RUM_TOKEN=<redacted:35 token-like>

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

257Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L258: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L259: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L354: patch L355: patchOriginalEncodingBase64 L356: questions { ... L1093: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1094: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1095: __typename ... L1681: const { url } = sourceCodeFile.signedFile; L1682: const sourceCodeRes = await fetch(url); L1683: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.mjsView on unpkg · L257

257Trigger-reachable chain: manifest.main -> dist/index.mjs L257: Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L258: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L259: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L354: patch L355: patchOriginalEncodingBase64 L356: questions { ... L1093: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1094: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1095: __typename ... L1681: const { url } = sourceCodeFile.signedFile; L1682: const sourceCodeRes = await fetch(url); L1683: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L257

•matchType = previous_version_dangerous_delta matchedPackage = mobbdev@1.4.36 matchedIdentity = npm:bW9iYmRldg:1.4.36 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.mjsView on unpkg

12600// src/utils/computerName.ts L12601: import { execSync } from "child_process"; L12602: import os from "os";

High

Child Process

Package source references child process execution.

dist/index.mjsView on unpkg · L12600

19230// src/features/claude_code/daemon-check-shim.tmpl.js L19231: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L19232:

High

Shell

Package source references shell execution.

dist/index.mjsView on unpkg · L19230

10565try { L10566: const getImportMetaUrl = new Function("return import.meta.url"); L10567: const importMetaUrl = getImportMetaUrl();

High

Eval

Package source references dynamic code evaluation.

dist/index.mjsView on unpkg · L10565

257Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L258: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L259: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L354: patch L355: patchOriginalEncodingBase64 L356: questions { ... L1093: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1094: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1095: __typename ... L1681: const { url } = sourceCodeFile.signedFile; L1682: const sourceCodeRes = await fetch(url); L1683: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/index.mjsView on unpkg · L257

19230// src/features/claude_code/daemon-check-shim.tmpl.js L19231: var daemon_check_shim_tmpl_default = "// Mobb daemon shim \u2014 checks if daemon is alive, spawns if dead.\n// Auto-generated by mobbdev CLI. Do not edit.\nvar fs = require('fs')\... L19232:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.mjsView on unpkg · L19230

4242const buildPath = "../../../../../[redacted]"; L4243: module = await import(buildPath); L4244: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.mjsView on unpkg · L4242

257Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L258: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L259: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L354: patch L355: patchOriginalEncodingBase64 L356: questions { ... L1093: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1094: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1095: __typename ... L1681: const { url } = sourceCodeFile.signedFile; L1682: const sourceCodeRes = await fetch(url); L1683: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.mjsView on unpkg · L257

Source & flagged code

12 flagged

package.jsonView file

Lines 1-31json

1{

2 "name": "mobbdev",

3 "version": "1.4.57",

4 "description": "Automated secure code remediation tool",

5 "repository": "git+https://github.com/mobb-dev/bugsy.git",

6 "main": "dist/index.mjs",

7 "module": "dist/index.mjs",

8 "scripts": {

9 "clean": "rm -rf build",

10 "env": "dotenv -e ./.env",

11 "postinstall": "node ./src/post_install/cx_install.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L11

12 "build": "tsc && tsup-node --env.NODE_ENV production",

13 "build:dev": "tsup-node --env.NODE_ENV development",

14 "build:binary": "node ./scripts/build_binary.mjs",

15 "build:binary:all": "node ./scripts/build_binary.mjs --all",

16 "increment-version": "./scripts/increment-version.sh",

17 "test:unit:mcp": "vitest run __tests__/mcp/",

18 "test:unit:mcp:ci": "vitest run --bail=1 __tests__/mcp/",

19 "test:mcp:watch": "vitest watch __tests__/mcp/",

20 "test:mcp:verbose": "pnpm run build && NODE_ENV=test VERBOSE=true vitest run __tests__/mcp/",

21 "test:mcp:all": "pnpm run test:unit:mcp && pnpm run test:integration:mcp && pnpm run test:e2e:mcp",

22 "test:unit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

23 "test:unit:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --exclude='**/__tests__/integration.test.ts' --exclude='**/__tests__/integration.mcp.test.ts' --exclude='**/__tests__/integration.baseline-commit.test.ts' --exclude='**/__tests__/mcp/**'",

24 "test:integration": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.test.ts",

25 "test:integration:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.test.ts",

26 "test:integration:baseline-commit": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

27 "test:integration:baseline-commit:proxy": "GIT_PROXY_HOST=http://tinyproxy:8888 HTTP_PROXY=http://localhost:8888 API_URL=http://app-api:8080/v1/graphql TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.baseline-commit.test.ts",

28 "test:integration:mcp": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

29 "test:integration:mcp:ci": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest run --bail=1 --sequence.concurrent=false false __tests__/integration.mcp.test.ts",

30 "test:integration:watch": "GIT_PROXY_HOST=http://tinyproxy:8888 TOKEN=$(../../scripts/login_auth0.sh) vitest watch run __tests__/integration.test.ts",

31 "test": "pnpm run test:unit && pnpm run test:integration",

Lines 1-10text

1# production@v21

2API_URL="https://api.mobb.ai/v1/graphql"

3WEB_APP_URL="https://app.mobb.ai"

4GITLAB_API_TOKEN=""

5GITHUB_API_TOKEN=""

6ADO_TEST_ACCESS_TOKEN=""

7HASURA_ACCESS_KEY=""

8LOCAL_GRAPHQL_ENDPOINT=""

9GIT_PROXY_HOST="http://tinyproxy:8888"

10DD_RUM_TOKEN="pubf59c0182545bfb4c299175119f1abf9b"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

.envView on unpkg · L4

dist/index.mjsView file

257Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L258: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L259: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L354: patch L355: patchOriginalEncodingBase64 L356: questions { ... L1093: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1094: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1095: __typename ... L1681: const { url } = sourceCodeFile.signedFile; L1682: const sourceCodeRes = await fetch(url); L1683: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/index.mjsView on unpkg · L257

257Trigger-reachable chain: manifest.main -> dist/index.mjs L257: Scan_Source_Enum2["CiBamboo"] = "CI_BAMBOO"; L258: Scan_Source_Enum2["CiCircleci"] = "CI_CIRCLECI"; L259: Scan_Source_Enum2["CiGithub"] = "CI_GITHUB"; ... L354: patch L355: patchOriginalEncodingBase64 L356: questions { ... L1093: query getFixWithAnswers($fixId: uuid!, $userInput: [QuestionAnswer!]!) { L1094: fixData: getFix(fixId: $fixId, userInput: $userInput, loadAnswers: false) { L1095: __typename ... L1681: const { url } = sourceCodeFile.signedFile; L1682: const sourceCodeRes = await fetch(url); L1683: if (Number(sourceCodeRes.headers.get("Content-Length")) > MAX_SOURCE_CODE_FILE_SIZE_IN_BYTES) {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.mjsView on unpkg · L257

•matchType = previous_version_dangerous_delta matchedPackage = mobbdev@1.4.36 matchedIdentity = npm:bW9iYmRldg:1.4.36 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file