nolo-cli@0.54.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nolo-cli@0.54.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

13 flagged · loading source

chunk-TR4DXUYX.jsView file

4546patternName = generic_password severity = medium line = 4546

Medium

Secret Pattern

Package contains a possible secret pattern.

chunk-TR4DXUYX.jsView on unpkg · L4546

11902var findModelConfig = async (modelName, provider) => { L11903: const { ALL_MODELS } = await import("./models-JVKUEER5.js"); L11904: const name = toTrimmedString(modelName);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunk-TR4DXUYX.jsView on unpkg · L11902

5862patternName = generic_password severity = medium line = 5862

Medium

Secret Pattern

Hardcoded password in chunk-TR4DXUYX.js

chunk-TR4DXUYX.jsView on unpkg · L5862

7121patternName = generic_password severity = medium line = 7121

Medium

Secret Pattern

Hardcoded password in chunk-TR4DXUYX.js

chunk-TR4DXUYX.jsView on unpkg · L7121

8301patternName = generic_password severity = medium line = 8301

Medium

Secret Pattern

Hardcoded password in chunk-TR4DXUYX.js

chunk-TR4DXUYX.jsView on unpkg · L8301

19993} L19994: const importBridge = new Function("specifier", "return import(specifier)"); L19995: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-TR4DXUYX.jsView on unpkg · L19993

readlineWorkspace-XUFJV3RS.jsView file

3730try { L3731: const proc = spawn(command, { L3732: stdin: "ignore",

High

Child Process

Package source references child process execution.

readlineWorkspace-XUFJV3RS.jsView on unpkg · L3730

3649if (platform === "win32") { L3650: const ps = which("powershell.exe") || which("powershell") || which("pwsh.exe") || which("pwsh"); L3651: if (!ps) {

High

Shell

Package source references shell execution.

readlineWorkspace-XUFJV3RS.jsView on unpkg · L3649

chunk-EJE33XNR.jsView file

170...titleParams ? { titleParams } : {}, L171: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L172: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L407: default: L408: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L409: } ... L441: while (i) { L442: h = h * 33 ^ str.charCodeAt(--i); L443: } ... L5426: }); L5427: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5428: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-EJE33XNR.jsView on unpkg · L170

chunk-T5HJEUQN.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nolo-cli@0.34.0-alpha.3 matchedIdentity = npm:bm9sby1jbGk:0.34.0-alpha.3 similarity = 0.508 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

chunk-T5HJEUQN.jsView on unpkg

23// packages/cli/windowsSelfUpdate.ts L24: import { spawn } from "node:child_process"; L25: import { ... L41: var UPDATE_LOCK_FILE = "update.lock"; L42: function resolveNoloHome(env, homeDir = homedir()) { L43: return env.NOLO_HOME?.trim() || join(homeDir, ".nolo"); L44: } L45: function resolveWindowsUpdateStatePath(env = process.env, homeDir = homedir()) { L46: return join(resolveNoloHome(env, homeDir), "updates", UPDATE_STATE_FILE); ... L74: const raw = readFileSync(lockPath, "utf8").trim(); L75: const owner = raw.startsWith("{") ? JSON.parse(raw).updateId : raw; L76: if (owner === updateId) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

chunk-T5HJEUQN.jsView on unpkg · L23

machineCommands-RK6L7ZWL.jsView file

6Cross-file remote execution chain: machineCommands-RK6L7ZWL.js spawns chunk-5FCIPEKT.js; helper contains network access plus dynamic code execution. L6: import { L7: isConnectorWebSocketAuthError, L8: [redacted], ... L152: // [redacted].ts L153: import { spawn } from "node:child_process"; L154: import { existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs"; ... L163: try { L164: return JSON.parse(readFileSync(path, "utf8")); L165: } catch { ... L174: const resolved = resolve(path); L175: return process.platform === "win32" ? resolved.toLowerCase() : resolved; L176: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

machineCommands-RK6L7ZWL.jsView on unpkg · L6

chunk-BY2FF2C4.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chunk-BY2FF2C4.js#virtual:normalized:round1View on unpkg

Source & flagged code

13 flagged

chunk-TR4DXUYX.jsView file

4546patternName = generic_password severity = medium line = 4546

Medium

Secret Pattern

Package contains a possible secret pattern.

chunk-TR4DXUYX.jsView on unpkg · L4546

11902var findModelConfig = async (modelName, provider) => { L11903: const { ALL_MODELS } = await import("./models-JVKUEER5.js"); L11904: const name = toTrimmedString(modelName);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

chunk-TR4DXUYX.jsView on unpkg · L11902

5862patternName = generic_password severity = medium line = 5862

Medium

Secret Pattern

Hardcoded password in chunk-TR4DXUYX.js

chunk-TR4DXUYX.jsView on unpkg · L5862

7121patternName = generic_password severity = medium line = 7121

Medium

Secret Pattern

Hardcoded password in chunk-TR4DXUYX.js

chunk-TR4DXUYX.jsView on unpkg · L7121

8301patternName = generic_password severity = medium line = 8301

Medium

Secret Pattern

Hardcoded password in chunk-TR4DXUYX.js

chunk-TR4DXUYX.jsView on unpkg · L8301

19993} L19994: const importBridge = new Function("specifier", "return import(specifier)"); L19995: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-TR4DXUYX.jsView on unpkg · L19993

readlineWorkspace-XUFJV3RS.jsView file

Lines 3629-3669javascript

3629 "\u8FDC\u7A0B\u4F1A\u8BDD\u65E0\u6CD5\u8BFB\u53D6\u672C\u5730\u526A\u8D34\u677F\uFF0C\u8BF7\u62D6\u5165\u56FE\u7247\u6587\u4EF6\u6216\u76F4\u63A5\u8F93\u5165\u56FE\u7247\u8DEF\u5F84"

3630 );

3631 }

3632 if (platform === "darwin") {

3633 const pngpaste =

chunk-EJE33XNR.jsView file

170...titleParams ? { titleParams } : {}, L171: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L172: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L407: default: L408: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L409: } ... L441: while (i) { L442: h = h * 33 ^ str.charCodeAt(--i); L443: } ... L5426: }); L5427: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5428: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-EJE33XNR.jsView on unpkg · L170

chunk-T5HJEUQN.jsView file

Lines 3-43javascript

3} from "./chunk-UNZDCI3O.js";

4import {

5 resolveDefaultSpawn

6} from "./chunk-IDZTNRP2.js";

7import {

8 isCompiledBinary

9} from "./chunk-A7GB5UGH.js";

machineCommands-RK6L7ZWL.jsView file

Lines 1-26javascript

1import {

2 buildMachinePermissionPromptBlock,

3 handleConnectorRunMessage,

4 resolveMachineRunPermissionPolicy

5} from "./chunk-JXIP6ZWH.js";

6import {

7 isConnectorWebSocketAuthError,

8 isConnectorWebSocketRetryableError,

High

Cross File Remote Execution Context

chunk-BY2FF2C4.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chunk-BY2FF2C4.js#virtual:normalized:round1View on unpkg