Loading npm security reports…

n8n-nodes-deepeval: Suspicious npm security report (Warn) | LPM Firewall

registry / n8n-nodes-deepeval / 1.0.0

n8n-nodes-deepeval@1.0.0

DeepEval benchmarking nodes for n8n

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEvalFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 1.32 MB of source, external domains: cdn.jsdelivr.net

Source & flagged code

9 flagged

dist/assets/pyodide/pyodide.asm.jsView file

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Child Process

Package source references child process execution.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

dist/nodes/metrics/DeepEvalConversationalDAG/DeepEvalConversationalDAG.node.jsView file

Lines 1-9javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_metric_definitions = require("../../../shared/metric-definitions-BfYv79EC.js");

3//#region src/nodes/metrics/DeepEvalConversationalDAG/DeepEvalConversationalDAG.node.ts

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pyodide/pyodide.asm.wasmView file

•path = dist/assets/pyodide/pyodide.asm.wasm kind = wasm_module sizeBytes = 10105545 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/pyodide/pyodide.asm.wasmView on unpkg

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView file

•path = dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl kind = high_entropy_blob sizeBytes = 14552 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView on unpkg

•path = dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl kind = compressed_blob sizeBytes = 14552 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView on unpkg

•path = dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 14552 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView on unpkg

Source & flagged code

9 flagged · loading source

dist/assets/pyodide/pyodide.asm.jsView file

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Child Process

Package source references child process execution.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

Findings

4 High6 Medium6 Low

HighChild Processdist/assets/pyodide/pyodide.asm.js

HighCommand Output Exfiltrationdist/assets/pyodide/pyodide.asm.js

HighObfuscated Payload Loaderdist/assets/pyodide/pyodide.asm.js

HighShips High Entropy Blobdist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl

MediumDynamic Requiredist/nodes/metrics/DeepEvalConversationalDAG/DeepEvalConversationalDAG.node.js

MediumNetwork

MediumProtestware

MediumShips Wasm Moduledist/assets/pyodide/pyodide.asm.wasm

MediumShips Compressed Blobdist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl

MediumStructural Risk Force Deep Review

LowEvaldist/assets/pyodide/pyodide.asm.js

Source & flagged code

9 flagged

dist/assets/pyodide/pyodide.asm.jsView file

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Child Process

Package source references child process execution.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

9L10: var Module=Object.assign({},moduleArg);var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=rej... L11:

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/assets/pyodide/pyodide.asm.jsView on unpkg · L9

dist/nodes/metrics/DeepEvalConversationalDAG/DeepEvalConversationalDAG.node.jsView file

Lines 1-9javascript

1Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });

2const require_metric_definitions = require("../../../shared/metric-definitions-BfYv79EC.js");

3//#region src/nodes/metrics/DeepEvalConversationalDAG/DeepEvalConversationalDAG.node.ts

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/pyodide/pyodide.asm.wasmView file

•path = dist/assets/pyodide/pyodide.asm.wasm kind = wasm_module sizeBytes = 10105545 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/assets/pyodide/pyodide.asm.wasmView on unpkg

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView file

•path = dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl kind = high_entropy_blob sizeBytes = 14552 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView on unpkg

•path = dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl kind = compressed_blob sizeBytes = 14552 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView on unpkg

•path = dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whl kind = nested_archive_needs_inspection sizeBytes = 14552 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/assets/python/wheels/typing_inspection-0.4.1-py3-none-any.whlView on unpkg