nexus-agents@2.173.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nexus-agents@2.173.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/chunk-ZM4O442V.jsView file

692patternName = private_key_rsa severity = critical line = 692 matchedText = " - Pri...-)",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-ZM4O442V.jsView on unpkg · L692

692patternName = private_key_rsa severity = critical line = 692 matchedText = " - Pri...-)",

Critical

Secret Pattern

RSA private key in dist/chunk-ZM4O442V.js

dist/chunk-ZM4O442V.jsView on unpkg · L692

dist/chunk-XAJLOBUL.jsView file

952}; L953: var DEFAULT_OLLAMA_HOST = "http://localhost:11434"; L954: var DEFAULT_MAX_TOKENS = 2048; ... L1224: parts.push({ L1225: inlineData: { L1226: mimeType: block.source.media_type, ... L8950: const fenced = extractCodeBlock(rawText); L8951: const parsed = JSON.parse(fenced?.[1] ?? rawText); L8952: const subtasks = parsed.map((item) => SubTaskSchema.safeParse(item)).filter((r) => r.success).map((r) => r.data); ... L9181: // -------------------------------------------------------------------------- L9182: // Private Methods L9183: // --------------------------------------------------------------------------

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/chunk-XAJLOBUL.jsView on unpkg · L952

952Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunk-XAJLOBUL.js L952: }; L953: var DEFAULT_OLLAMA_HOST = "http://localhost:11434"; L954: var DEFAULT_MAX_TOKENS = 2048; ... L1224: parts.push({ L1225: inlineData: { L1226: mimeType: block.source.media_type, ... L8950: const fenced = extractCodeBlock(rawText); L8951: const parsed = JSON.parse(fenced?.[1] ?? rawText); L8952: const subtasks = parsed.map((item) => SubTaskSchema.safeParse(item)).filter((r) => r.success).map((r) => r.data); ... L9181: // -------------------------------------------------------------------------- L9182: // Private Methods L9183: // --------------------------------------------------------------------------

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunk-XAJLOBUL.jsView on unpkg · L952

36735

src/security/ast-rules/fixtures/sample.pyView file

•path = src/security/ast-rules/fixtures/sample.py kind = payload_in_excluded_dir sizeBytes = 1192 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

src/security/ast-rules/fixtures/sample.pyView on unpkg

•path = src/security/ast-rules/fixtures/sample.py kind = build_helper sizeBytes = 1192 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/security/ast-rules/fixtures/sample.pyView on unpkg

dist/chunk-5WFHSWQG.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nexus-agents@2.172.0 matchedIdentity = npm:bmV4dXMtYWdlbnRz:2.172.0 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-5WFHSWQG.jsView on unpkg

dist/cli.jsView file

18685patternName = aws_access_key severity = critical line = 18685 matchedText = code: 'c...";',

Critical

Secret Pattern

AWS access key ID in dist/cli.js

dist/cli.jsView on unpkg · L18685