nginxforge-panel@1.0.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nginxforge-panel@1.0.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nginxforge.mjsView file

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16:

High

Child Process

Package source references child process execution.

bin/nginxforge.mjsView on unpkg · L14

47} else { L48: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable --now nginxforge.service"`, { stdio: "ignore" }); L49: }

High

Shell

Package source references shell execution.

bin/nginxforge.mjsView on unpkg · L47

14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L45: fs.writeFileSync(serviceFile, sContent, "utf8"); L46: execSync("systemctl daemon-reload && systemctl enable --now nginxforge.service", { stdio: "ignore" }); L47: } else { ... L77: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L78: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L79: stdio: "inherit",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/nginxforge.mjsView on unpkg · L14

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L45: fs.writeFileSync(serviceFile, sContent, "utf8"); L46: execSync("systemctl daemon-reload && systemctl enable --now nginxforge.service", { stdio: "ignore" }); L47: } else { ... L77: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L78: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L79: stdio: "inherit",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/nginxforge.mjsView on unpkg · L14

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5681 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 20-60json

20 "license": "MIT",

21 "bin": {

22 "nginxforge": "./bin/nginxforge.mjs"

23 },

24 "files": [

25 "dist",

26 "bin",

27 "scripts",

28 "agent",

29 "shared",

30 "install.sh",

31 "package.json",

32 "README.md",

33 "LICENSE"

34 ],

35 "scripts": {

36 "dev": "NODE_ENV=development tsx watch server/_core/index.ts",

37 "build": "vite build && esbuild server/_core/index.ts --platform=node --packages=external --bundle --format=esm --outdir=dist",

38 "start": "NODE_ENV=production node dist/index.js",

39 "setup": "node scripts/system-installer.mjs",

40 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L40

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "prepublishOnly": "pnpm build && pnpm release-check",

42 "check": "tsc --noEmit",

43 "format": "prettier --write .",

44 "test": "vitest run",

45 "release-check": "node scripts/release-check.mjs",

46 "db:push": "drizzle-kit generate && drizzle-kit migrate"

47 },

48 "dependencies": {

49 "@aws-sdk/client-s3": "^3.693.0",

50 "@aws-sdk/s3-request-presigner": "^3.693.0",

51 "@hookform/resolvers": "^5.2.2",

52 "@monaco-editor/react": "^4.7.0",

53 "@node-rs/argon2": "^2.1.0",

54 "@radix-ui/react-accordion": "^1.2.12",

55 "@radix-ui/react-alert-dialog": "^1.1.15",

56 "@radix-ui/react-aspect-ratio": "^1.1.7",

57 "@radix-ui/react-avatar": "^1.1.10",

58 "@radix-ui/react-checkbox": "^1.3.3",

59 "@radix-ui/react-collapsible": "^1.1.12",

60 "@radix-ui/react-context-menu": "^2.2.16",

bin/nginxforge.mjsView file

Lines 1-67javascript

1#!/usr/bin/env node

2/**

3 * NginxForge CLI Entrypoint

4 * Supports:

5 * nginxforge setup - Interactively detect and install required system tools & runtimes

6 * nginxforge check - Run production health checks

7 * nginxforge start - Start the NginxForge production control plane

8 */

9

10import path from "node:path"

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5681 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg