nolo-cli@0.65.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

nolo-cli@0.65.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged · loading source

chunk-CQ2OZMLQ.jsView file

•matchType = token_shingles matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-72COHDZR.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-CQ2OZMLQ.jsView on unpkg

4713patternName = generic_password severity = medium line = 4713

Medium

Secret Pattern

Package contains a possible secret pattern.

chunk-CQ2OZMLQ.jsView on unpkg · L4713

6029patternName = generic_password severity = medium line = 6029

Medium

Secret Pattern

Hardcoded password in chunk-CQ2OZMLQ.js

chunk-CQ2OZMLQ.jsView on unpkg · L6029

7288patternName = generic_password severity = medium line = 7288

Medium

Secret Pattern

Hardcoded password in chunk-CQ2OZMLQ.js

chunk-CQ2OZMLQ.jsView on unpkg · L7288

8468patternName = generic_password severity = medium line = 8468

Medium

Secret Pattern

Hardcoded password in chunk-CQ2OZMLQ.js

chunk-CQ2OZMLQ.jsView on unpkg · L8468

20442} L20443: const importBridge = new Function("specifier", "return import(specifier)"); L20444: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-CQ2OZMLQ.jsView on unpkg · L20442

chunk-YCDWJX45.jsView file

23// packages/cli/windowsSelfUpdate.ts L24: import { spawn } from "node:child_process"; L25: import {

High

Child Process

Package source references child process execution.

chunk-YCDWJX45.jsView on unpkg · L23

51const windowsRoot = env.SystemRoot?.trim() || env.WINDIR?.trim(); L52: const powershellPath = overrides.powershellPath ?? (windowsRoot ? join( L53: windowsRoot,

High

Shell

Package source references shell execution.

chunk-YCDWJX45.jsView on unpkg · L51

23// packages/cli/windowsSelfUpdate.ts L24: import { spawn } from "node:child_process"; L25: import { ... L41: var UPDATE_LOCK_FILE = "update.lock"; L42: function resolveNoloHome(env, homeDir = homedir()) { L43: return env.NOLO_HOME?.trim() || join(homeDir, ".nolo"); L44: } L45: function resolveWindowsUpdateStatePath(env = process.env, homeDir = homedir()) { L46: return join(resolveNoloHome(env, homeDir), "updates", UPDATE_STATE_FILE); ... L74: const raw = readFileSync(lockPath, "utf8").trim(); L75: const owner = raw.startsWith("{") ? JSON.parse(raw).updateId : raw; L76: if (owner === updateId) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

chunk-YCDWJX45.jsView on unpkg · L23

•

chunk-3ROJR3TG.jsView file

181...titleParams ? { titleParams } : {}, L182: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L183: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L418: default: L419: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L420: } ... L452: while (i) { L453: h = h * 33 ^ str.charCodeAt(--i); L454: } ... L5462: }); L5463: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5464: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-3ROJR3TG.jsView on unpkg · L181

machineCommands-SCGLQQCA.jsView file

6Cross-file remote execution chain: machineCommands-SCGLQQCA.js spawns chunk-3ROJR3TG.js; helper contains network access plus dynamic code execution. L6: import { L7: isConnectorWebSocketAuthError, L8: [redacted], ... L159: // [redacted].ts L160: import { spawn } from "node:child_process"; L161: import { existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs"; ... L170: try { L171: return JSON.parse(readFileSync(path, "utf8")); L172: } catch { ... L181: const resolved = resolve(path); L182: return process.platform === "win32" ? resolved.toLowerCase() : resolved; L183: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

machineCommands-SCGLQQCA.jsView on unpkg · L6

dist-VODFSGNG.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = dist-VODFSGNG.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-VODFSGNG.jsView on unpkg

chunk-MP64VFGD.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-JDSUTNYY.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-MP64VFGD.jsView on unpkg

chunk-IDZTNRP2.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-IDZTNRP2.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-IDZTNRP2.jsView on unpkg

chunk-M5PVFLD4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-M5PVFLD4.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-M5PVFLD4.jsView on unpkg

clipboardy-BX4NMYHE.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = nolo-cli@0.54.0 matchedIdentity = npm:bm9sby1jbGk:0.54.0 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

clipboardy-BX4NMYHE.jsView on unpkg