nginxforge-panel@1.0.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nginxforge-panel@1.0.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nginxforge.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = nginxforge-panel@1.0.2 matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.2 similarity = 0.975 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/nginxforge.mjsView on unpkg

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16:

High

Child Process

Package source references child process execution.

bin/nginxforge.mjsView on unpkg · L14

84} else { L85: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable nginxforge.service"`, { stdio: "ignore" }); L86: }

High

Shell

Package source references shell execution.

bin/nginxforge.mjsView on unpkg · L84

14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/nginxforge.mjsView on unpkg · L14

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/nginxforge.mjsView on unpkg · L14

dist/index.jsView file

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L15

15import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: scripts.start -> dist/index.js L15: import express2 from "express"; L16: import { createServer } from "http"; L17: import net2 from "net"; ... L21: var ENV = { L22: appId: process.env.VITE_APP_ID ?? "", L23: cookieSecret: process.env.JWT_SECRET ?? "", ... L36: if (!key) { L37: res.status(400).send("Missing storage key"); L38: return; ... L53: if (!forgeResp.ok) { L54: const body = await forgeResp.text().catch(() => ""); L55: console.error(`[StorageProxy] forge error: ${forgeResp.status} ${body}`);

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/system-installer.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = scripts/system-installer.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/system-installer.mjsView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.804 matchedPath = web-dist/assets/cytoscape.esm-DTSO7Bv0.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView on unpkg

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView on unpkg