Loading npm security reports…
nginxforge-panel@1.1.7: Install hook abuse – npm package flagged | LPM Firewall
Flagged — allowed with a warning
Allowed by default policy, but 33 finding(s) warrant review before installing.
nginxforge-panel@1.1.7 Modern VPS Hosting Control Panel with Automated Nginx, Zero-Downtime Deployments, Let's Encrypt TLS, Multi-Tenant Database Management, and AI Copilot.
scanned 2mo ago · by lpm-firewall-ai The automatic lifecycle hook creates a concrete and risky install-time system-mutation surface. The code is transparent and hosting-related, but the default-on privileged changes warrant a warning rather than publication approval.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
npm installation in an interactive terminal
Impact
Unexpected host package installation and service activation
Mechanism
Automatic lifecycle invocation of a privileged system installer
AI rationale
The automatic lifecycle hook creates a concrete and risky install-time system-mutation surface. The code is transparent and hosting-related, but the default-on privileged changes warrant a warning rather than publication approval.
Evidence
package.json scripts/postinstall.mjs scripts/system-installer.mjs
public snapshot AI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
The npm postinstall hook automatically launches the system installer in an interactive terminal. Missing host tools are accepted by default, then installed with elevated package-manager commands. The installer enables and starts host services, creating significant install-time system changes. Evidence against
The hook does not run the installer when output is non-interactive. The affected tools and service names are explicit and match a hosting-control-panel purpose. No self-dependency or hidden lifecycle network endpoint was found. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell
Supply chain HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings
24 flagged · loading source • scripts.postinstall = node scripts/postinstall.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/postinstall.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 14 import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
High Child Process
Package source references child process execution.
bin/nginxforge.mjs View on unpkg · L14 3 Critical 16 High 7 Medium 7 Low
Critical Persistence Backdoor dist/index.js
Critical Trigger Reachable Dangerous Capability dist/index.js
Critical Previous Version Dangerous Delta dist/index.js
High Install Time Lifecycle Scripts package.json
High Child Process bin/nginxforge.mjs
High Shell bin/nginxforge.mjs
High Credential Redirect Persistence dist/index.js
High Remote Agent Bridge dist/index.js
High Cross File Remote Execution Context bin/nginxforge.mjs
High Spawned Bundled Service Listener bin/nginxforge.mjs
High Trigger Reachable Persistence dist/index.js
High Known Malware Source Similarity
Affected versions and remediation This report applies to nginxforge-panel@1.1.7 .
See all versions of nginxforge-panel for other recorded verdicts.
Review the evidence and your use of nginxforge-panel@1.1.7 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-09-04 03:26:40.518Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
Manifest
No manifest risk signals triggered.
scanned 567 file(s), 14.7 MB of source, external domains: 10.0.0.10, 127.0.0.1, ai.example.test, api.anthropic.com, api.deepseek.com, api.groq.com, api.mysaas.com, api.openai.com, bad.example, cdn.jsdelivr.net, chevrotain.io, developer.mozilla.org, dotenvx.com, en.wikipedia.org, evil.example.com, example.com, forge.butterfly-effect.dev, forge.manus.im, generativelanguage.googleapis.com, git.io, github.com, jquery.org, langium.org, llm.example.com, nginxforge.dev, openrouter.ai, panel.example.com, radix-ui.com, react.dev, stackoverflow.com, tldrlegal.com, www.w3.org
Oversized source lightweight scan
dist/index.js 2.90 MB file, sampled 256 KB
Filesystem ChildProcess EnvironmentVars Eval DynamicRequire PossibleObfuscation HighEntropyStrings UrlStrings developer.mozilla.org dotenvx.com git.io github.com stackoverflow.com
84
} else {
L85: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable nginxforge.service"`, { stdio: "ignore" });
L86: }
14 Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L14: import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/nginxforge.mjs View on unpkg · L14 14 Detached bundled service listener: bin/nginxforge.mjs spawns dist/index.js; helper exposes a broad-bound HTTP listener.
L14: import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
High Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
bin/nginxforge.mjs View on unpkg · L14 • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = bin/nginxforge.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/nginxforge.mjs View on unpkg 14 import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/nginxforge.mjs View on unpkg · L14 40 L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
Critical Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/index.js View on unpkg · L40 40 Trigger-reachable chain: scripts.start -> dist/index.js
L40:
L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg · L40 • matchType = previous_version_dangerous_delta
matchedPackage = nginxforge-panel@1.0.4
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.4
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.js View on unpkg • Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var parentUrl = req.baseUrl || "";
var done = restore(out, req, "baseUrl", "next", "params");
req.baseUrl = parentUrl;
req.baseUrl = parentUrl;
req.baseUrl = parentUrl + (removed[removed.length - 1] === "/" ? removed.substring(0, removed.length - 1) : removed);
removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
databaseUrl: process.env.DATABASE_URL ?? "",
headers: { Authorization: `Bearer ${ENV.forgeApiKey}` }
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.js View on unpkg 316 try {
L317: const parsed = DotenvModule.parse(fs24.readFileSync(path21, { encoding }));
L318: DotenvModule.populate(parsedAll, parsed, options);
...
L18355: var parentParams = req.params;
L18356: var parentUrl = req.baseUrl || "";
L18357: var done = restore(out, req, "baseUrl", "next", "params");
...
L59398: gitArgs.push(cleanUrl, tmpFolder);
L59399: const { execFileSync: execFileSync11 } = await import("node:child_process");
L59400: execFileSync11("git", gitArgs, { timeout: 35e3 });
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.js View on unpkg · L316 40 Trigger-reachable persistence chain: scripts.start -> dist/index.js
L40:
L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.js View on unpkg · L40 • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/index.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg • matchType = malicious_source_fingerprint_signature
signature = af420a72f1e4dc81
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/index.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
shingleOverlap = 62
summary = package final verdict is malicious
High Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.js View on unpkg 1 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
L2: var __create = Object.create;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L1 703 site.name = fn.name;
L704: var deprecatedfn = new Function(
L705: "fn",
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/index.js View on unpkg · L703 • path = install.sh
kind = build_helper
sizeBytes = 6069
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
install.sh View on unpkg • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = scripts/postinstall.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = scripts/system-installer.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/system-installer.mjs View on unpkg dist/public/assets/cytoscape.esm-DtBltrT8.js View file • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/public/assets/cytoscape.esm-DtBltrT8.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/cytoscape.esm-DtBltrT8.js View on unpkg dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js View file • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js View on unpkg dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js View file • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js View on unpkg dist/index.js
High Known Malware Source Similarity bin/nginxforge.mjs
High Known Malware Source Similarity scripts/postinstall.mjs
High Known Malware Source Similarity scripts/system-installer.mjs
High Known Malware Source Similarity dist/public/assets/cytoscape.esm-DtBltrT8.js
High Known Malware Source Similarity dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js
High Known Malware Source Similarity dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js
High Known Malware Source Fingerprint Signature dist/index.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist/index.js
Medium Install Persistence bin/nginxforge.mjs
Medium Ships Build Helper install.sh
Medium Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
19.4 MB · 732 files
1 signature(s)
Install lifecycle postinstall prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem NativeBindings Network Shell HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings Manifest: clean
24 flagged • scripts.postinstall = node scripts/postinstall.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/postinstall.mjs
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 14 import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
High Child Process
Package source references child process execution.
bin/nginxforge.mjs View on unpkg · L14 84 } else {
L85: execSync(`sudo bash -c "cat << 'EOF' > ${serviceFile}\n${sContent}\nEOF\nsystemctl daemon-reload && systemctl enable nginxforge.service"`, { stdio: "ignore" });
L86: }
14 Cross-file remote execution chain: bin/nginxforge.mjs spawns dist/index.js; helper contains network access plus dynamic code execution.
L14: import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
bin/nginxforge.mjs View on unpkg · L14 14 Detached bundled service listener: bin/nginxforge.mjs spawns dist/index.js; helper exposes a broad-bound HTTP listener.
L14: import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
High Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
bin/nginxforge.mjs View on unpkg · L14 • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = bin/nginxforge.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
bin/nginxforge.mjs View on unpkg 14 import fs from "node:fs";
L15: import { execFileSync, execSync } from "node:child_process";
L16:
L17: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L18: const ROOT_DIR = path.resolve(__dirname, "..");
...
L82: fs.writeFileSync(serviceFile, sContent, "utf8");
L83: execSync("systemctl daemon-reload && systemctl enable nginxforge.service", { stdio: "ignore" });
L84: } else {
...
L120: execFileSync(nodeBin, [path.join(ROOT_DIR, "dist", "index.js")], {
L121: env: { ...process.env, NODE_ENV: "production", PORT: "3222" },
L122: stdio: "inherit",
...
L160: console.log(` ${token}`);
Medium Install Persistence
Source writes installer persistence such as shell profile or service configuration.
bin/nginxforge.mjs View on unpkg · L14 40 L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
Critical Persistence Backdoor
Source writes persistence or remote-access backdoor material.
dist/index.js View on unpkg · L40 40 Trigger-reachable chain: scripts.start -> dist/index.js
L40:
L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
Critical Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/index.js View on unpkg · L40 • matchType = previous_version_dangerous_delta
matchedPackage = nginxforge-panel@1.0.4
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.0.4
similarity = 0.983
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
• path = install.sh
kind = build_helper
sizeBytes = 6069
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
install.sh View on unpkg • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = scripts/postinstall.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/postinstall.mjs View on unpkg • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = scripts/system-installer.mjs
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
scripts/system-installer.mjs View on unpkg dist/public/assets/cytoscape.esm-DtBltrT8.js View file • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/public/assets/cytoscape.esm-DtBltrT8.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/cytoscape.esm-DtBltrT8.js View on unpkg dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js View file • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/diagram-PSM6KHXK-DVKN-u96.js View on unpkg dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js View file • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/public/assets/flowDiagram-NV44I4VS-mzGsMG3d.js View on unpkg This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.js
• Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
dist/index.js:
var parentUrl = req.baseUrl || "";
var done = restore(out, req, "baseUrl", "next", "params");
req.baseUrl = parentUrl;
req.baseUrl = parentUrl;
req.baseUrl = parentUrl + (removed[removed.length - 1] === "/" ? removed.substring(0, removed.length - 1) : removed);
removeMatchingHeaders(/^(?:(?:proxy-)?authorization|cookie)$/i, this._options.headers);
databaseUrl: process.env.DATABASE_URL ?? "",
headers: { Authorization: `Bearer ${ENV.forgeApiKey}` }
High Credential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
dist/index.js View on unpkg 316 try {
L317: const parsed = DotenvModule.parse(fs24.readFileSync(path21, { encoding }));
L318: DotenvModule.populate(parsedAll, parsed, options);
...
L18355: var parentParams = req.params;
L18356: var parentUrl = req.baseUrl || "";
L18357: var done = restore(out, req, "baseUrl", "next", "params");
...
L59398: gitArgs.push(cleanUrl, tmpFolder);
L59399: const { execFileSync: execFileSync11 } = await import("node:child_process");
L59400: execFileSync11("git", gitArgs, { timeout: 35e3 });
High Remote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
dist/index.js View on unpkg · L316 40 Trigger-reachable persistence chain: scripts.start -> dist/index.js
L40:
L41: // node_modules/.pnpm/dotenv@17.2.3/node_modules/dotenv/package.json
L42: var require_package = __commonJS({
...
L76: },
L77: homepage: "https://github.com/motdotla/dotenv#readme",
L78: funding: "https://dotenvx.com",
...
L145: function supportsAnsi() {
L146: return process.stdout.isTTY;
L147: }
...
L176: if (!result.parsed) {
L177: const err = new Error(`MISSING_DATA: Cannot parse ${vaultPath} for an unknown reason`);
L178: err.code = "MISSING_DATA";
High Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
dist/index.js View on unpkg · L40 • matchType = normalized_sha256
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/index.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.js View on unpkg • matchType = malicious_source_fingerprint_signature
signature = af420a72f1e4dc81
signatureType = suspicious_hashes
sourceLabel = final_verdict:malicious
matchedPackage = nginxforge-panel@1.1.6
matchedPath = dist/index.js
matchedIdentity = npm:bmdpbnhmb3JnZS1wYW5lbA:1.1.6
similarity = 1.000
shingleOverlap = 62
summary = package final verdict is malicious
High Known Malware Source Fingerprint Signature
Source fingerprint signature matches a known malicious package signature; route for source-aware review.
dist/index.js View on unpkg 1 import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
L2: var __create = Object.create;
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist/index.js View on unpkg · L1 703 site.name = fn.name;
L704: var deprecatedfn = new Function(
L705: "fn",
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/index.js View on unpkg · L703