noblox-asset.js@7.4.1: Malicious npm security report (Block)

Loading npm security reports…

noblox-asset.js@7.4.1: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

examples/cleanPlayers.jsView file

34// Dependencies L35: const noblox = require('noblox.js') L36: const logUpdate = require('log-update')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/cleanPlayers.jsView on unpkg · L34

lib/datastores/setDatastoreEntry.jsView file

32* @example const noblox = require("noblox.js") L33: * const response = await noblox.setDatastoreEntry({ universeId: 127407415, datastoreName: 'LevelStore', entryKey: 'Level_Random', body: 230, robloxEntryUserIDs: [55549140], robloxE... L34: **/ ... L53: 'Content-Type': 'application/json', L54: 'content-md5': crypto.createHash('md5').update(JSON.stringify(body)).digest('base64'), L55: 'roblox-entry-userids': JSON.stringify(robloxEntryUserIDs),

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/datastores/setDatastoreEntry.jsView on unpkg · L32

lib/util/relog.jsView file

•matchType = normalized_sha256 matchedPackage = noblox-asset.js@7.6.0 matchedPath = lib/util/relog.js matchedIdentity = npm:bm9ibG94LWFzc2V0Lmpz:7.6.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/util/relog.jsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

examples/cleanPlayers.jsView file

34// Dependencies L35: const noblox = require('noblox.js') L36: const logUpdate = require('log-update')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

examples/cleanPlayers.jsView on unpkg · L34

lib/datastores/setDatastoreEntry.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/datastores/setDatastoreEntry.jsView on unpkg · L32

lib/util/relog.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/util/relog.jsView on unpkg

noblox-asset.js@7.4.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code