nginxforge-panel@1.0.5: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

nginxforge-panel@1.0.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

20 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/nginxforge.mjsView file

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16:

High

Child Process

Package source references child process execution.

bin/nginxforge.mjsView on unpkg · L14

84} else { L85: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable nginxforge.service"`, { stdio: "ignore" }); L86: }

High

Shell

Package source references shell execution.

bin/nginxforge.mjsView on unpkg · L84

14Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution. L14: import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit",

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/nginxforge.mjsView on unpkg · L14

14import fs from "node:fs"; L15: import { execFileSync, execSync } from "node:child_process"; L16: L17: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L18: const ROOT_DIR = path.resolve(__dirname, ".."); ... L82: fs.writeFileSync(serviceFile, sContent, "utf8"); L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" }); L84: } else { ... L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], { L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" }, L122: stdio: "inherit",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/nginxforge.mjsView on unpkg · L14

dist/index.jsView file

22ENV = { L23: appId: process.env.VITE_APP_ID ?? "", L24: cookieSecret: process.env.JWT_SECRET ?? "", ... L347: responseStatus: int("responseStatus"), L348: responseBody: text("responseBody"), L349: error: text("error"), ... L1399: } catch { L1400: const localDir = path2.join(process.cwd(), "panel_data"); L1401: if (!fs2.existsSync(localDir)) fs2.mkdirSync(localDir, { recursive: true }); ... L3058: import express2 from "express"; L3059: import { createServer } from "http"; L3060: import net2 from "net";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L22

22ENV = { L23: appId: process.env.VITE_APP_ID ?? "", L24: cookieSecret: process.env.JWT_SECRET ?? "", ... L347: responseStatus: int("responseStatus"), L348: responseBody: text("responseBody"), L349: error: text("error"), ... L1399: } catch { L1400: const localDir = path2.join(process.cwd(), "panel_data"); L1401: if (!fs2.existsSync(localDir)) fs2.mkdirSync(localDir, { recursive: true }); ... L3058: import express2 from "express"; L3059: import { createServer } from "http"; L3060: import net2 from "net";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L22

22Trigger-reachable chain: scripts.start -> dist/index.js L22: ENV = { L23: appId: process.env.VITE_APP_ID ?? "", L24: cookieSecret: process.env.JWT_SECRET ?? "", ... L347: responseStatus: int("responseStatus"), L348: responseBody: text("responseBody"), L349: error: text("error"), ... L1399: } catch { L1400: const localDir = path2.join(process.cwd(), "panel_data"); L1401: if (!fs2.existsSync(localDir)) fs2.mkdirSync(localDir, { recursive: true }); ... L3058: import express2 from "express"; L3059: import { createServer } from "http"; L3060: import net2 from "net";

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/system-installer.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = scripts/system-installer.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/system-installer.mjsView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.804 matchedPath = web-dist/assets/cytoscape.esm-DTSO7Bv0.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView on unpkg

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView on unpkg

Source & flagged code

20 flagged

package.jsonView file

Lines 26-66json

26 "server",

27 "client",

28 "bin",

29 "scripts",

30 "agent",

31 "shared",

32 "pgadmin-ui",

33 "install.sh",

34 "drizzle.config.ts",

35 "vite.config.ts",

36 "tsconfig.json",

37 "package.json",

38 "README.md",

39 "LICENSE"

40 ],

41 "scripts": {

42 "dev": "NODE_ENV=development tsx watch server/_core/index.ts",

43 "build": "vite build && esbuild server/_core/index.ts --platform=node --packages=external --bundle --format=esm --outdir=dist",

44 "start": "NODE_ENV=production node dist/index.js",

45 "setup": "node scripts/system-installer.mjs",

46 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 "prepublishOnly": "pnpm build && pnpm release-check",

48 "check": "tsc --noEmit",

49 "format": "prettier --write .",

50 "test": "vitest run",

51 "release-check": "node scripts/release-check.mjs",

52 "db:push": "drizzle-kit generate && drizzle-kit migrate"

53 },

54 "dependencies": {

55 "@aws-sdk/client-s3": "^3.693.0",

56 "@aws-sdk/s3-request-presigner": "^3.693.0",

57 "@hookform/resolvers": "^5.2.2",

58 "@monaco-editor/react": "^4.7.0",

59 "@node-rs/argon2": "^2.1.0",

60 "@radix-ui/react-accordion": "^1.2.12",

61 "@radix-ui/react-alert-dialog": "^1.1.15",

62 "@radix-ui/react-aspect-ratio": "^1.1.7",

63 "@radix-ui/react-avatar": "^1.1.10",

64 "@radix-ui/react-checkbox": "^1.3.3",

65 "@radix-ui/react-collapsible": "^1.1.12",

66 "@radix-ui/react-context-menu": "^2.2.16",

bin/nginxforge.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * NginxForge CLI Entrypoint

4 * Supports:

5 * nginxforge setup - Interactively detect and install required system tools & runtimes

6 * nginxforge check - Run production health checks

7 * nginxforge start - Start the NginxForge production control plane

8 */

9

10import path from "node:path"

dist/index.jsView file

22ENV = { L23: appId: process.env.VITE_APP_ID ?? "", L24: cookieSecret: process.env.JWT_SECRET ?? "", ... L347: responseStatus: int("responseStatus"), L348: responseBody: text("responseBody"), L349: error: text("error"), ... L1399: } catch { L1400: const localDir = path2.join(process.cwd(), "panel_data"); L1401: if (!fs2.existsSync(localDir)) fs2.mkdirSync(localDir, { recursive: true }); ... L3058: import express2 from "express"; L3059: import { createServer } from "http"; L3060: import net2 from "net";

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/index.jsView on unpkg · L22

22ENV = { L23: appId: process.env.VITE_APP_ID ?? "", L24: cookieSecret: process.env.JWT_SECRET ?? "", ... L347: responseStatus: int("responseStatus"), L348: responseBody: text("responseBody"), L349: error: text("error"), ... L1399: } catch { L1400: const localDir = path2.join(process.cwd(), "panel_data"); L1401: if (!fs2.existsSync(localDir)) fs2.mkdirSync(localDir, { recursive: true }); ... L3058: import express2 from "express"; L3059: import { createServer } from "http"; L3060: import net2 from "net";

Critical

Persistence Backdoor

Source writes persistence or remote-access backdoor material.

dist/index.jsView on unpkg · L22

22Trigger-reachable chain: scripts.start -> dist/index.js L22: ENV = { L23: appId: process.env.VITE_APP_ID ?? "", L24: cookieSecret: process.env.JWT_SECRET ?? "", ... L347: responseStatus: int("responseStatus"), L348: responseBody: text("responseBody"), L349: error: text("error"), ... L1399: } catch { L1400: const localDir = path2.join(process.cwd(), "panel_data"); L1401: if (!fs2.existsSync(localDir)) fs2.mkdirSync(localDir, { recursive: true }); ... L3058: import express2 from "express"; L3059: import { createServer } from "http"; L3060: import net2 from "net";

install.shView file

•path = install.sh kind = build_helper sizeBytes = 6069 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

scripts/postinstall.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = scripts/postinstall.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/postinstall.mjsView on unpkg

scripts/system-installer.mjsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = scripts/system-installer.mjs matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/system-installer.mjsView on unpkg

dist/public/assets/cytoscape.esm-DtBltrT8.jsView file

•matchType = normalized_sha256 matchedPackage = @jait/gateway@0.1.804 matchedPath = web-dist/assets/cytoscape.esm-DTSO7Bv0.js matchedIdentity = npm:QGphaXQvZ2F0ZXdheQ:0.1.804 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/cytoscape.esm-DtBltrT8.jsView on unpkg

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/diagram-PSM6KHXK-DVKN-u96.jsView on unpkg

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView file

•matchType = normalized_sha256 matchedPackage = nginxforge-panel@1.0.3 matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.jsView on unpkg