numbl: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

numbl: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.install = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-lib/node.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = numbl@0.4.19 matchedIdentity = npm:bnVtYmw:0.4.19 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-lib/node.jsView on unpkg

20import { unzipSync, zipSync } from "fflate"; L21: import { execFileSync } from "child_process"; L22: import { homedir, tmpdir } from "os";

High

Child Process

Package source references child process execution.

dist-lib/node.jsView on unpkg · L20

dist-lib/lib.jsView file

67473}; L67474: const factory = new Function( L67475: "RTV",

High

Eval

Package source references dynamic code evaluation.

dist-lib/lib.jsView on unpkg · L67473

dist-cli/cli.jsView file

16}); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist-cli/cli.jsView on unpkg · L16

101627const t = setTimeout(() => ac.abort(), ${timeoutMs}); L101628: fetch(${JSON.stringify(url)}, { ...${JSON.stringify(fetchOpts)}, signal: ac.signal }) L101629: .then(r => { clearTimeout(t); if (!r.ok) throw new Error('HTTP ' + r.status); return r.arrayBuffer(); }) L101630: .then(buf => require('fs').writeFileSync(${JSON.stringify(dest)}, Buffer.from(buf))) L101631: .catch(e => { process.stderr.write(e.message + '\\n'); process.exit(1); }); L101632: `; L101633: try { L101634: execFileSync(process.execPath, ["-e", script], { L101635: stdio: ["ignore", "ignore", "pipe"],

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-cli/cli.jsView on unpkg · L101627

16Cross-file remote execution chain: dist-cli/cli.js spawns dist-graphics/index.js; helper contains network access plus dynamic code execution. L16: }); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView file

•path = dist-site-viewer/assets/hdf5_hl-C9YUKPMe.js kind = oversized_source_file sizeBytes = 4784586 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView on unpkg

Source & flagged code

13 flagged

package.jsonView file

Lines 51-91json

51 "native/",

52 "binding.gyp"

53 ],

54 "scripts": {

55 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

56 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

57 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

58 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

59 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

60 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

61 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

62 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

63 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

64 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

65 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

66 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build && npm run prerender:seo",

67 "prerender:seo": "tsx scripts/prerender-seo.ts",

68 "build:lib": "npm run build:snippets && npm run bundle:stdlib && esbuild src/lib.ts --bundle --platform=node --format=esm --outfile=dist-lib/lib.js --packages=external --loader:.wasm=file && esbuild src/node.ts --bundle --platform=node --format=esm --outfile=dist-lib/node.js --packages=external && tsc -p tsconfig.lib.json",

69 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

70 "build:graphics": "esbuild src/graphics-lib.ts --bundle --platform=browser --format=esm --outfile=dist-graphics/index.js --external:react --external:react-dom --external:react/jsx-runtime --external:h5wasm --jsx=automatic && tsc -p tsconfig.graphics.json",

71 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 "build:addon": "node-gyp rebuild",

73 "format": "prettier --write .",

74 "format:check": "prettier --check .",

75 "lint": "eslint .",

76 "typecheck": "tsc -b",

77 "preview": "vite preview",

78 "test": "vitest run",

79 "test:coverage": "vitest run --coverage",

80 "test:coverage:all": "bash scripts/coverage-all.sh",

81 "test:scripts": "bash numbl_test_scripts/run_all.sh",

82 "jit-parity": "node jit_parity/run.mjs",

83 "test:browser": "playwright test",

84 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

85 "update-readme": "tsx scripts/update-readme-usage.ts",

86 "check-readme": "tsx scripts/update-readme-usage.ts --check",

87 "bump": "tsx scripts/bump-version.ts",

88 "prepublishOnly": "npm run build:lib && npm run build:browser && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

89 "prepare": "husky",

90 "build:browser": "npm run build:snippets && npm run bundle:stdlib && tsx scripts/build_browser.ts"

91 },

dist-lib/node.jsView file

Lines 1-40javascript

1// src/cli-fileio.ts

2import {

3 openSync,

4 closeSync,

5 readSync,

6 writeSync,

7 readFileSync as readFileSync2,

8 writeFileSync,

9 statSync as statSync2,

10 fstatSync,

dist-lib/lib.jsView file

67473}; L67474: const factory = new Function( L67475: "RTV",

High

Eval

Package source references dynamic code evaluation.

dist-lib/lib.jsView on unpkg · L67473

dist-cli/cli.jsView file

16}); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist-cli/cli.jsView on unpkg · L16

101627const t = setTimeout(() => ac.abort(), ${timeoutMs}); L101628: fetch(${JSON.stringify(url)}, { ...${JSON.stringify(fetchOpts)}, signal: ac.signal }) L101629: .then(r => { clearTimeout(t); if (!r.ok) throw new Error('HTTP ' + r.status); return r.arrayBuffer(); }) L101630: .then(buf => require('fs').writeFileSync(${JSON.stringify(dest)}, Buffer.from(buf))) L101631: .catch(e => { process.stderr.write(e.message + '\\n'); process.exit(1); }); L101632: `; L101633: try { L101634: execFileSync(process.execPath, ["-e", script], { L101635: stdio: ["ignore", "ignore", "pipe"],

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-cli/cli.jsView on unpkg · L101627

16Cross-file remote execution chain: dist-cli/cli.js spawns dist-graphics/index.js; helper contains network access plus dynamic code execution. L16: }); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView file

•path = dist-site-viewer/assets/hdf5_hl-C9YUKPMe.js kind = oversized_source_file sizeBytes = 4784586 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView on unpkg