nginxforge-panel@1.0.2: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nginxforge-panel@1.0.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nginxforge.mjsView file

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16:

High

Child Process

Package source references child process execution.

bin/nginxforge.mjsView on unpkg · L14

67} else { L68: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable --now nginxforge.service"`, { stdio: "ignore" }); L69: }

High

Shell

Package source references shell execution.

bin/nginxforge.mjsView on unpkg · L67

14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L65: fs.writeFileSync(serviceFile, sContent, "utf8"); L66: execSync("systemctl daemon-reload && systemctl enable --now nginxforge.service", { stdio: "ignore" }); L67: } else { ... L96: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L97: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L98: stdio: "inherit",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/nginxforge.mjsView on unpkg · L14

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L65: fs.writeFileSync(serviceFile, sContent, "utf8"); L66: execSync("systemctl daemon-reload && systemctl enable --now nginxforge.service", { stdio: "ignore" }); L67: } else { ... L96: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L97: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L98: stdio: "inherit",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/nginxforge.mjsView on unpkg · L14

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5681 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

Source & flagged code

15 flagged

package.jsonView file

Lines 25-65json

25 "dist",

26 "server",

27 "client",

28 "bin",

29 "scripts",

30 "agent",

31 "shared",

32 "install.sh",

33 "drizzle.config.ts",

34 "vite.config.ts",

35 "tsconfig.json",

36 "package.json",

37 "README.md",

38 "LICENSE"

39 ],

40 "scripts": {

41 "dev": "NODE_ENV=development tsx watch server/_core/index.ts",

42 "build": "vite build && esbuild server/_core/index.ts --platform=node --packages=external --bundle --format=esm --outdir=dist",

43 "start": "NODE_ENV=production node dist/index.js",

44 "setup": "node scripts/system-installer.mjs",

45 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "prepublishOnly": "pnpm build && pnpm release-check",

47 "check": "tsc --noEmit",

48 "format": "prettier --write .",

49 "test": "vitest run",

50 "release-check": "node scripts/release-check.mjs",

51 "db:push": "drizzle-kit generate && drizzle-kit migrate"

52 },

53 "dependencies": {

54 "@aws-sdk/client-s3": "^3.693.0",

55 "@aws-sdk/s3-request-presigner": "^3.693.0",

56 "@hookform/resolvers": "^5.2.2",

57 "@monaco-editor/react": "^4.7.0",

58 "@node-rs/argon2": "^2.1.0",

59 "@radix-ui/react-accordion": "^1.2.12",

60 "@radix-ui/react-alert-dialog": "^1.1.15",

61 "@radix-ui/react-aspect-ratio": "^1.1.7",

62 "@radix-ui/react-avatar": "^1.1.10",

63 "@radix-ui/react-checkbox": "^1.3.3",

64 "@radix-ui/react-collapsible": "^1.1.12",

65 "@radix-ui/react-context-menu": "^2.2.16",

bin/nginxforge.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * NginxForge CLI Entrypoint

4 * Supports:

5 * nginxforge setup - Interactively detect and install required system tools & runtimes

6 * nginxforge check - Run production health checks

7 * nginxforge start - Start the NginxForge production control plane

8 */

9

10import path from "node:path"

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5681 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg