nolo-cli@0.83.0: Unknown npm security report (Allow) | LPM Firewall

Loading npm security reports…

nolo-cli@0.83.0: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

16 flagged · loading source

chunk-QVKRR2SS.jsView file

7370patternName = generic_password severity = medium line = 7370

Medium

Secret Pattern

Package contains a possible secret pattern.

chunk-QVKRR2SS.jsView on unpkg · L7370

8728patternName = generic_password severity = medium line = 8728

Medium

Secret Pattern

Hardcoded password in chunk-QVKRR2SS.js

chunk-QVKRR2SS.jsView on unpkg · L8728

10029patternName = generic_password severity = medium line = 10029

Medium

Secret Pattern

Hardcoded password in chunk-QVKRR2SS.js

chunk-QVKRR2SS.jsView on unpkg · L10029

11251patternName = generic_password severity = medium line = 11251

Medium

Secret Pattern

Hardcoded password in chunk-QVKRR2SS.js

chunk-QVKRR2SS.jsView on unpkg · L11251

machineCommands-GFPTOY6L.jsView file

164// [redacted].ts L165: import { spawn } from "node:child_process"; L166: import { existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

machineCommands-GFPTOY6L.jsView on unpkg · L164

6Cross-file remote execution chain: machineCommands-GFPTOY6L.js spawns chunk-5FBTLSFG.js; helper contains network access plus dynamic code execution. L6: import { L7: isConnectorWebSocketAuthError, L8: [redacted], ... L164: // [redacted].ts L165: import { spawn } from "node:child_process"; L166: import { existsSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync } from "node:fs"; ... L175: try { L176: return JSON.parse(readFileSync(path, "utf8")); L177: } catch { ... L186: const resolved = resolve(path); L187: return process.platform === "win32" ? resolved.toLowerCase() : resolved; L188: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

machineCommands-GFPTOY6L.jsView on unpkg · L6

chunk-SSDAAEC2.jsView file

11462const res = spawnSync(cmd, { L11463: shell: true, L11464: cwd: cwd || process.cwd(),

High

Shell

Package source references shell execution.

chunk-SSDAAEC2.jsView on unpkg · L11462

chunk-5FBTLSFG.jsView file

8212} L8213: const importBridge = new Function("specifier", "return import(specifier)"); L8214: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-5FBTLSFG.jsView on unpkg · L8212

dist-VODFSGNG.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = dist-VODFSGNG.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist-VODFSGNG.jsView on unpkg

33"use strict"; L34: var fs = __require("fs"); L35: var LDD_PATH = "/usr/bin/ldd";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-VODFSGNG.jsView on unpkg · L33

chunk-6VFARHZW.jsView file

193...titleParams ? { titleParams } : {}, L194: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L195: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L430: default: L431: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L432: } ... L464: while (i) { L465: h = h * 33 ^ str.charCodeAt(--i); L466: } ... L5474: }); L5475: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5476: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-6VFARHZW.jsView on unpkg · L193

chunk-JEDZAO7L.jsView file

23// packages/cli/windowsSelfUpdate.ts L24: import { spawn } from "node:child_process"; L25: import { ... L41: var UPDATE_LOCK_FILE = "update.lock"; L42: function resolveNoloHome(env, homeDir = homedir()) { L43: return env.NOLO_HOME?.trim() || join(homeDir, ".nolo"); L44: } L45: function resolveWindowsUpdateStatePath(env = process.env, homeDir = homedir()) { L46: return join(resolveNoloHome(env, homeDir), "updates", UPDATE_STATE_FILE); ... L74: const raw = readFileSync(lockPath, "utf8").trim(); L75: const owner = raw.startsWith("{") ? JSON.parse(raw).updateId : raw; L76: if (owner === updateId) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

chunk-JEDZAO7L.jsView on unpkg · L23

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-T5HJEUQN.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-JEDZAO7L.jsView on unpkg

chromeCommands-FZYAU75D.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chromeCommands-FZYAU75D.js#virtual:normalized:round1View on unpkg

chunk-MP64VFGD.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-JDSUTNYY.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-MP64VFGD.jsView on unpkg

chunk-M5PVFLD4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-M5PVFLD4.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-M5PVFLD4.jsView on unpkg

Source & flagged code

16 flagged

chunk-QVKRR2SS.jsView file

7370patternName = generic_password severity = medium line = 7370

Medium

Secret Pattern

Package contains a possible secret pattern.

chunk-QVKRR2SS.jsView on unpkg · L7370

8728patternName = generic_password severity = medium line = 8728

Medium

Secret Pattern

Hardcoded password in chunk-QVKRR2SS.js

chunk-QVKRR2SS.jsView on unpkg · L8728

10029patternName = generic_password severity = medium line = 10029

Medium

Secret Pattern

Hardcoded password in chunk-QVKRR2SS.js

chunk-QVKRR2SS.jsView on unpkg · L10029

11251patternName = generic_password severity = medium line = 11251

Medium

Secret Pattern

Hardcoded password in chunk-QVKRR2SS.js

chunk-QVKRR2SS.jsView on unpkg · L11251

machineCommands-GFPTOY6L.jsView file

Lines 1-26javascript

1import {

2 buildMachinePermissionPromptBlock,

3 handleConnectorRunMessage,

4 resolveMachineRunPermissionPolicy

5} from "./chunk-45C5ER5U.js";

6import {

7 isConnectorWebSocketAuthError,

8 isConnectorWebSocketRetryableError,

High

Cross File Remote Execution Context

chunk-SSDAAEC2.jsView file

Lines 11442-11482javascript

11442 }

11443 return buildAgentsMdLayer(content, name);

11444 } catch {

11445 }

11446 }

11447 return null;

11448}

11449

chunk-5FBTLSFG.jsView file

8212} L8213: const importBridge = new Function("specifier", "return import(specifier)"); L8214: const { readXPostWithBridge } = await importBridge("../../integrations/x-[redacted].ts");

Low

Eval

Package source references a known benign dynamic code generation pattern.

chunk-5FBTLSFG.jsView on unpkg · L8212

dist-VODFSGNG.jsView file

Lines 13-53javascript

13 var getReport = () => {

14 if (!report) {

15 if (isLinux() && process.report) {

16 const orig

chunk-6VFARHZW.jsView file

193...titleParams ? { titleParams } : {}, L194: ...asOptionalTrimmedString(value.body) ? { body: asOptionalTrimmedString(value.body) } : {}, L195: ...Object.prototype.hasOwnProperty.call(value, "payload") ? { payload: value.payload } : {} ... L430: default: L431: throw new Error(`BUG: unhandled typeof ${typeof self} - please report an issue at https://github.com/Effect-TS/effect/issues`); L432: } ... L464: while (i) { L465: h = h * 33 ^ str.charCodeAt(--i); L466: } ... L5474: }); L5475: var LogToStderr = /* @__PURE__ */ Reference("effect/Logger/LogToStderr", { L5476: defaultValue: constFalse

Low

Weak Crypto

Package source references weak cryptographic algorithms.

chunk-6VFARHZW.jsView on unpkg · L193

chunk-JEDZAO7L.jsView file

Lines 3-43javascript

3} from "./chunk-BYMV6QZG.js";

4import {

5 resolveDefaultSpawn

6} from "./chunk-X7HHHIOZ.js";

7import {

8 isCompiledBinary

9} from "./chunk-A7GB5UGH.js";

chromeCommands-FZYAU75D.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

chromeCommands-FZYAU75D.js#virtual:normalized:round1View on unpkg

chunk-MP64VFGD.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-JDSUTNYY.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-MP64VFGD.jsView on unpkg

chunk-M5PVFLD4.jsView file

•matchType = normalized_sha256 matchedPackage = nolo-cli@0.52.0-alpha.1 matchedPath = chunk-M5PVFLD4.js matchedIdentity = npm:bm9sby1jbGk:0.52.0-alpha.1 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

chunk-M5PVFLD4.jsView on unpkg