node-karin: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

node-karin: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/redis-aLJ7wbJH.mjsView file

1494if (isWin()) { L1495: const result = await exec("redis-server.exe redis.conf", { booleanResult: true }); L1496: if (result) return result;

High

Child Process

Package source references child process execution.

dist/redis-aLJ7wbJH.mjsView on unpkg · L1494

dist/cli/index.cjsView file

331stdio: "inherit", L332: shell: true L333: });

High

Shell

Package source references shell execution.

dist/cli/index.cjsView on unpkg · L331

324try { L325: (0, node_child_process.spawn)(process.platform === "win32" ? "pm2.cmd" : "pm2", [ L326: "logs", ... L334: } catch (error) { L335: console.error("[pm2] 发生未知错误: 请检查pm2是否安装【npm install -g pm2】"); L336: console.error(error);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.cjsView on unpkg · L324

dist/web/sha256.min.jsView file

8*/ L9: !function(){"use strict";function t(t,i){i?(d[0]=d[16]=d[1]=d[2]=d[3]=d[4]=d[5]=d[6]=d[7]=d[8]=d[9]=d[10]=d[11]=d[12]=d[13]=d[14]=d[15]=0,this.blocks=d):this.blocks=[0,0,0,0,0,0,0,...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web/sha256.min.jsView on unpkg · L8

dist/ws-CcoWd3Ar.mjsView file

7//#region src/adapter/render/connect/ws.ts L8: var WebSocketRender = class { L9: /** websocket实例 */ ... L26: const raw = event.toString(); L27: const { echo, action, status, data } = JSON.parse(raw); L28: logger.debug(`[WebSocket] ${echo} ${action} ${status}`); ... L64: if (!isPublic(data.file)) { L65: logger.warn(`[WebSocket] 访问的路径非法: echo: ${echo} data: ${JSON.stringify(data)}`); L66: return this.socket.send(JSON.stringify({

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/ws-CcoWd3Ar.mjsView on unpkg · L7

dist/index.mjsView file

9import { a as setTaskCallback, i as removeTaskCallback, n as getTaskCallback, t as executeTask } from "./queue-CnKedaZA.mjs"; L10: import { $ as TASK_LOGS_ROUTER, A as GET_TERMINAL_LIST_ROUTER, B as PLUGIN_ADMIN_ROUTER, C as GET_PLUGIN_CONFIG_ROUTER, D as GET_PLUGIN_MARKET_LIST_ROUTER, E as GET_PLUGIN_LIST_ROU... L11: import { c as ini, d as parseGithubUrl, f as getFastRegistry, g as logger$1, h as raceRequest, l as buildGithub, m as pingRequest, p as getPackageJson, s as createINIParser, u as g... ... L21: import fs from "node:fs"; L22: import { execSync } from "node:child_process"; L23: import { URL, fileURLToPath } from "node:url"; L24: import chokidar from "chokidar"; L25: import axios from "axios"; L26: import { EventEmitter } from "node:events";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.mjsView on unpkg · L9

dist/web/googleapis.woff2View file

•path = dist/web/googleapis.woff2 kind = high_entropy_blob sizeBytes = 3636288 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/googleapis.woff2View on unpkg

dist/web/assets/js/entry-DHm9nPtI.jsView file

•path = dist/web/assets/js/entry-DHm9nPtI.js kind = oversized_source_file sizeBytes = 9184282 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web/assets/js/entry-DHm9nPtI.jsView on unpkg

Source & flagged code

8 flagged

dist/redis-aLJ7wbJH.mjsView file

Lines 1474-1514javascript

1474* @param options Redis 客户端配置

1475* @returns Redis 客户端

1476*/

1477const create = async (options) => {

1478 try {

1479 const client = createClient(options);

1480 await client.connect();

1481 Object.defineProperty(client, "id", { value: "Redis" });

1482 return client;

1483 } catch (error) {

1484 logger.debug(`${logger.red("[redis] 启动失败:")} ${JSON.stringify(options)}`);

1485 logger.debug(error);

1486 }

1487};

1488/**

1489* @description 尝试主动拉起 Redis

1490* @returns 是否成功

1491*/

1492const start = async () => {

1493 logger.debug("[redis] 正在尝试启动 Redis...");

1494 if (isWin()) {

1495 const result = await exec("redis-server.exe redis.conf", { booleanResult: true });

1496 if (result) return result;

High

Child Process

Package source references child process execution.

dist/redis-aLJ7wbJH.mjsView on unpkg · L1494

1497 return await exec("net start Redis", { booleanResult: true });

1498 }

1499 return await exec("redis-server --save 300 10 --daemonize yes" + await isArm64(), { booleanResult: true });

1500};

1501/**

1502* @description Redis 服务

1503* @returns Redis 客户端

1504*/

1505const createRedis = async () => {

1506 try {

1507 const options = redis$1();

1508 let client = await create(options);

1509 if (client) {

1510 logger.info(`[redis] ${logger.green("Redis 连接成功")}`);

1511 redis = client;

1512 return redis;

1513 }

1514 if (await start()) {

dist/cli/index.cjsView file

Lines 304-351javascript

304 }

305 console.log("[pm2] 启动成功");

306 console.log("[pm2] 重启服务: pnpm rs");

307 console.log("[pm2] 查看日志: pnpm log");

308 console.log("[pm2] 停止服务: pnpm stop");

309

dist/web/sha256.min.jsView file

Lines 1-9javascript

1/**

2 * [js-sha256]{@link https://github.com/emn178/js-sha256}

3 *

4 * @version 0.11.0

5 * @author Chen, Yi-Cyuan [emn178@gmail.com]

6 * @copyright Chen, Yi-Cyuan 2014-2024

dist/ws-CcoWd3Ar.mjsView file

Lines 1-27javascript

1import { x as isPublic } from "./internal-DupfycKE.mjs";

2import { o as registerRender, u as unregisterRender } from "./cache-CPcPeo6N.mjs";

3import { n as renderTpl } from "./template-Djk6y0uC.mjs";

dist/index.mjsView file

Lines 1-29javascript

1import { t as __exportAll } from "./chunk-NzVPYdc1.mjs";

2import root_default, { basePath, commentPath, configPath, consolePath, dataPath, dbPath, defaultConfigPath, defaultViewPath, htmlPath, isPackaged, isPkg, karinDir, karinMain, karinPathBase, karinPathComment, karinPathConfig, karinPathConsole, karinPathData, karinPathDb, karinPathDefaultConfig, karinPathDefaultView, karinPathHtml, karinPathKv, karinPathLogs, karinPathMain, karinPathPlugins, karinPathPm2Config, karinPathRedisSqlite3, karinPathResource, karinPathRoot, karinPathSandboxData, karinPathSandboxTemp, karinPathTaskDb, karinPathTemp, kvPath, logsPath, pluginDir, pm2Path, redisSqlite3Path ...

3import { $ as createBotOfflineNotice, $r as yaml, $t as PrivateFileUploadedNotice, A as getAllBotID, An as getRemotePkgVersion, Ar as makeMessage, At as

dist/web/googleapis.woff2View file

•path = dist/web/googleapis.woff2 kind = high_entropy_blob sizeBytes = 3636288 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/web/googleapis.woff2View on unpkg

dist/web/assets/js/entry-DHm9nPtI.jsView file

•path = dist/web/assets/js/entry-DHm9nPtI.js kind = oversized_source_file sizeBytes = 9184282 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/web/assets/js/entry-DHm9nPtI.jsView on unpkg