moltspay@2.4.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

moltspay@2.4.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

68var import_fs3 = require("fs"); L69: var import_http = require("http"); L70: var path3 = __toESM(require("path")); ... L87: const envPaths = [ L88: path.join(process.cwd(), ".env"), L89: path.join(process.env.HOME || "", ".moltspay", ".env") L90: ]; ... L155: requestPath: urlPath, L156: requestBody: body L157: }); ... L212: }); L213: const result = await response.json();

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/index.jsView on unpkg · L68

68Trigger-reachable chain: manifest.main -> dist/index.js L68: var import_fs3 = require("fs"); L69: var import_http = require("http"); L70: var path3 = __toESM(require("path")); ... L87: const envPaths = [ L88: path.join(process.cwd(), ".env"), L89: path.join(process.env.HOME || "", ".moltspay", ".env") L90: ]; ... L155: requestPath: urlPath, L156: requestBody: body L157: }); ... L212: }); L213: const result = await response.json();

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L68

5514// src/client/alipay/cli.ts L5515: var import_child_process = require("child_process"); L5516:

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L5514

•Manifest-reachable source loads a private key from the environment, derives a near-full-balance transfer, and submits it to a package-fixed recipient. dist/index.js: error: `Wrong recipient: ${toAddress}, expected ${expectedTo}` this.serverPrivateKey = serverPrivateKey || process.env.BNB_SERVER_PRIVATE_KEY || ""; return { valid: false, error: `Wrong recipient: ${intent.to}` }; const balance = await this.getBalance(intent.from, intent.token, config.rpc); return { success: false, error: "Server wallet not configured (BNB_SERVER_PRIVATE_KEY)" }; return { valid: false, error: `Wrong recipient: ${toAddress}` }; async getBalance(account, token, rpcUrl) { * 2. Transfer instruction matches expected amount and recipient

High

Fixed Recipient Near Full Balance Transfer

Manifest-reachable source uses an environment private key to transfer nearly the full wallet balance to a fixed recipient.

dist/index.jsView on unpkg

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.js: var CDP_URL = "https://api.cdp.coinbase.com/platform/v2/x402"; rpc: "https://mainnet.base.org", explorer: "https://basescan.org/address/", explorerTx: "https://basescan.org/tx/", rpc: "https://polygon-bor-rpc.publicnode.com", explorer: "https://polygonscan.com/address/", explorerTx: "https://polygonscan.com/tx/", rpc: "https://sepolia.base.org",

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.jsView on unpkg

dist/cdp/index.jsView file

39module.exports = __toCommonJS(cdp_exports); L40: var fs = __toESM(require("fs")); L41: var path = __toESM(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cdp/index.jsView on unpkg · L39

dist/cli/index.jsView file

38var import_crypto = require("crypto"); L39: var import_dns = __toESM(require("dns")); L40: var import_commander = require("commander"); ... L263: }; L264: var BNB_SPONSOR_KEY = process.env.MOLTSPAY_BNB_SPONSOR_KEY; L265: var BNB_SPENDER_ADDRESS = process.env.MOLTSPAY_BNB_SPENDER || "[redacted]"; ... L269: ]; L270: var DEFAULT_CONFIG_DIR = (0, import_path.join)((0, import_os.homedir)(), ".moltspay"); L271: var PID_FILE = (0, import_path.join)(DEFAULT_CONFIG_DIR, "server.pid"); ... L288: const sponsorWallet = new import_ethers.ethers.Wallet(BNB_SPONSOR_KEY, provider); L289: const tx = await sponsorWallet.sendTransaction({ L290: to: wallet.address,

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L38

Source & flagged code

9 flagged

package.jsonView file

Lines 48-88json

48 "types": "./dist/client/web/index.d.mts"

49 },

50 "./chains": "./dist/chains/index.js",

51 "./wallet": "./dist/wallet/index.js",

52 "./facilitators": {

53 "require": "./dist/facilitators/index.js",

54 "import": "./dist/facilitators/index.mjs",

55 "types": "./dist/facilitators/index.d.ts"

56 },

57 "./mcp": {

58 "require": "./dist/mcp/index.js",

59 "import": "./dist/mcp/index.mjs",

60 "types": "./dist/mcp/index.d.ts"

61 }

62 },

63 "bin": {

64 "moltspay": "./dist/cli/index.js",

65 "moltspay-mcp": "./dist/mcp/index.js"

66 },

67 "scripts": {

68 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L68

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L68

69 "prebuild": "rm -rf dist",

70 "build": "tsup",

71 "dev": "tsup --watch",

72 "test": "vitest",

73 "test:run": "vitest run",

74 "lint": "eslint src/",

75 "typecheck": "tsc --noEmit",

76 "verify:web": "node scripts/verify-web-bundle.mjs",

77 "verify:alipay:offline": "tsx scripts/alipay-offline-e2e.mts",

78 "verify:alipay:http": "tsx scripts/alipay-http-402.mts",

79 "prepublishOnly": "npm run typecheck && npm run build && npm run verify:web"

80 },

81 "dependencies": {

82 "@alipay/agent-payment": "^1.0.14",

83 "@modelcontextprotocol/sdk": "^1.29.0",

84 "@solana/spl-token": "^0.4.14",

85 "@solana/web3.js": "^1.98.4",

86 "@x402/fetch": "^2.7.0",

87 "bs58": "^6.0.0",

88 "commander": "^12.0.0",

dist/index.jsView file

Lines 48-88javascript

48 getChainById: () => getChainById,

49 getDefaultRegistry: () => getDefaultRegistry,

50 getTransactionStatus: () => getTransactionStatus,

51 getWalletAddress: () => getWalletAddress,

52 initCDPWallet

dist/cdp/index.jsView file

Lines 19-59javascript

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) :

dist/cli/index.jsView file

Lines 18-58javascript

18 return to;

19};

20var __toESM = (mod, isNodeMode, target) => (target = mod != null ?