Loading npm security reports…

nginxforge-panel@1.0.3: Malicious npm security report (Block) | LPM Firewall

registry / nginxforge-panel / 1.0.3

nginxforge-panel@1.0.3

Modern VPS Hosting Control Panel with Automated Nginx, Zero-Downtime Deployments, Let's Encrypt TLS, Multi-Tenant Database Management, and AI Copilot.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Installing the package in an interactive terminal invokes a host dependency installer. It can install operating-system packages and start database or web-server services.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

npm, pnpm, or yarn installation with lifecycle scripts enabled in an interactive terminal.

Impact

Unexpected host-wide software installation and service persistence or startup during dependency installation.

Mechanism

Postinstall execution of a privileged host package installer and service activation.

Attack narrative

A normal package installation can enter the postinstall hook. When stdout is a terminal, that hook starts the system installer. For missing tools, the installer accepts the default affirmative response, invokes the detected operating-system package manager, and then enables and starts selected services through systemctl. These actions modify the consumer host during dependency installation and are not limited to installing this npm package.

Rationale

The source establishes an automatic npm lifecycle path to host-wide package installation and service activation. This concrete install-time mutation warrants blocking even though the installer prints prompts.

Evidence

package.jsonscripts/postinstall.mjsscripts/system-installer.mjs/etc/systemd/system/usr/bin/apt-get/usr/bin/dnf/usr/bin/yum/usr/bin/pacman/usr/bin/apk

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nginxforge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = nginxforge-panel@1.0.2 matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.2 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/nginxforge.mjsView on unpkg

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16:

High

Child Process

Package source references child process execution.

bin/nginxforge.mjsView on unpkg · L14

67} else { L68: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable --now nginxforge.service"`, { stdio: "ignore" }); L69: }

High

Shell

Package source references shell execution.

bin/nginxforge.mjsView on unpkg · L67

14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L65: fs.writeFileSync(serviceFile, sContent, "utf8"); L66: execSync("systemctl daemon-reload && systemctl enable --now nginxforge.service", { stdio: "ignore" }); L67: } else { ... L103: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L104: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L105: stdio: "inherit",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/nginxforge.mjsView on unpkg · L14

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L65: fs.writeFileSync(serviceFile, sContent, "utf8"); L66: execSync("systemctl daemon-reload && systemctl enable --now nginxforge.service", { stdio: "ignore" }); L67: } else { ... L103: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L104: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L105: stdio: "inherit",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/nginxforge.mjsView on unpkg · L14

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5681 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

Source & flagged code

16 flagged

package.jsonView file

Lines 26-66json

26 "server",

27 "client",

28 "bin",

29 "scripts",

30 "agent",

31 "shared",

32 "pgadmin-ui",

33 "install.sh",

34 "drizzle.config.ts",

35 "vite.config.ts",

36 "tsconfig.json",

37 "package.json",

38 "README.md",

39 "LICENSE"

40 ],

41 "scripts": {

42 "dev": "NODE_ENV=development tsx watch server/_core/index.ts",

43 "build": "vite build && esbuild server/_core/index.ts --platform=node --packages=external --bundle --format=esm --outdir=dist",

44 "start": "NODE_ENV=production node dist/index.js",

45 "setup": "node scripts/system-installer.mjs",

46 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "prepublishOnly": "pnpm build && pnpm release-check",

48 "check": "tsc --noEmit",

49 "format": "prettier --write .",

50 "test": "vitest run",

51 "release-check": "node scripts/release-check.mjs",

52 "db:push": "drizzle-kit generate && drizzle-kit migrate"

53 },

54 "dependencies": {

55 "@aws-sdk/client-s3": "^3.693.0",

56 "@aws-sdk/s3-request-presigner": "^3.693.0",

57 "@hookform/resolvers": "^5.2.2",

58 "@monaco-editor/react": "^4.7.0",

59 "@node-rs/argon2": "^2.1.0",

60 "@radix-ui/react-accordion": "^1.2.12",

61 "@radix-ui/react-alert-dialog": "^1.1.15",

62 "@radix-ui/react-aspect-ratio": "^1.1.7",

63 "@radix-ui/react-avatar": "^1.1.10",

64 "@radix-ui/react-checkbox": "^1.3.3",

65 "@radix-ui/react-collapsible": "^1.1.12",

66 "@radix-ui/react-context-menu": "^2.2.16",

bin/nginxforge.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * NginxForge CLI Entrypoint

4 * Supports:

5 * nginxforge setup - Interactively detect and install required system tools & runtimes

6 * nginxforge check - Run production health checks

7 * nginxforge start - Start the NginxForge production control plane

8 */

9

10import path from "node:path"

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 5681 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = termdock@1.4.122 matchedPath = dist/client/assets/cytoscape.esm-D3_iZ_3b.js matchedIdentity = npm:dGVybWRvY2s:1.4.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg