numbl@0.4.19: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

numbl@0.4.19: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.install = true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist-lib/node.jsView file

20import { unzipSync, zipSync } from "fflate"; L21: import { execFileSync } from "child_process"; L22: import { homedir, tmpdir } from "os";

High

Child Process

Package source references child process execution.

dist-lib/node.jsView on unpkg · L20

305const t = setTimeout(() => ac.abort(), ${timeoutMs}); L306: fetch(${JSON.stringify(url)}, { ...${JSON.stringify(fetchOpts)}, signal: ac.signal }) L307: .then(r => { clearTimeout(t); if (!r.ok) throw new Error('HTTP ' + r.status); return r.arrayBuffer(); }) L308: .then(buf => require('fs').writeFileSync(${JSON.stringify(dest)}, Buffer.from(buf))) L309: .catch(e => { process.stderr.write(e.message + '\\n'); process.exit(1); }); L310: `; L311: try { L312: execFileSync(process.execPath, ["-e", script], { L313: stdio: ["ignore", "ignore", "pipe"],

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-lib/node.jsView on unpkg · L305

305Trigger-reachable command-output exfiltration chain: manifest.exports -> dist-lib/node.js L305: const t = setTimeout(() => ac.abort(), ${timeoutMs}); L306: fetch(${JSON.stringify(url)}, { ...${JSON.stringify(fetchOpts)}, signal: ac.signal }) L307: .then(r => { clearTimeout(t); if (!r.ok) throw new Error('HTTP ' + r.status); return r.arrayBuffer(); }) L308: .then(buf => require('fs').writeFileSync(${JSON.stringify(dest)}, Buffer.from(buf))) L309: .catch(e => { process.stderr.write(e.message + '\\n'); process.exit(1); }); L310: `; L311: try { L312: execFileSync(process.execPath, ["-e", script], { L313: stdio: ["ignore", "ignore", "pipe"],

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist-lib/node.jsView on unpkg · L305

dist-lib/lib.jsView file

64173}; L64174: const factory = new Function( L64175: "RTV",

High

Eval

Package source references dynamic code evaluation.

dist-lib/lib.jsView on unpkg · L64173

dist-browser/browser.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist-browser/browser.js: var worker_code_default = 'var __defProp = Object.defineProperty;\nvar __export = (target, all2) => {\n for (var name in all2)\n __defProp(target, name, { get: all2[name], enum... writeFile(path, content) { this.post({ type: "writeFile", path, content });

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist-browser/browser.jsView on unpkg

dist-cli/cli.jsView file

16}); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist-cli/cli.jsView on unpkg · L16

•matchType = previous_version_dangerous_delta matchedPackage = numbl@0.4.12 matchedIdentity = npm:bnVtYmw:0.4.12 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-cli/cli.jsView on unpkg

16Cross-file remote execution chain: dist-cli/cli.js spawns dist-graphics/index.js; helper contains network access plus dynamic code execution. L16: }); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView file

•path = dist-site-viewer/assets/hdf5_hl-C9YUKPMe.js kind = oversized_source_file sizeBytes = 4784586 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView on unpkg

Source & flagged code

14 flagged

package.jsonView file

Lines 51-91json

51 "native/",

52 "binding.gyp"

53 ],

54 "scripts": {

55 "dev": "npm run build:snippets && npm run bundle:stdlib && vite",

56 "build": "npm run build:web && npm run build:test-runner && npm run copy:test-scripts && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

57 "build:plot-viewer": "vite build --config vite.plot-viewer.config.ts",

58 "build:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.site-viewer.config.ts",

59 "dev:site-viewer": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.site-viewer.config.ts",

60 "build:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite build --config vite.test-runner.config.ts",

61 "dev:test-runner": "npm run build:snippets && npm run bundle:stdlib && vite --config vite.test-runner.config.ts",

62 "copy:test-scripts": "tsx scripts/copy-test-scripts.ts",

63 "bundle:stdlib": "tsx scripts/bundle-stdlib.ts",

64 "build:snippets": "tsx scripts/build_runtime_snippets.ts",

65 "build:snippets:check": "tsx scripts/build_runtime_snippets.ts --check",

66 "build:web": "npm run build:snippets && npm run bundle:stdlib && tsc -b && vite build && npm run prerender:seo",

67 "prerender:seo": "tsx scripts/prerender-seo.ts",

68 "build:lib": "npm run build:snippets && npm run bundle:stdlib && esbuild src/lib.ts --bundle --platform=node --format=esm --outfile=dist-lib/lib.js --packages=external --loader:.wasm=file && esbuild src/node.ts --bundle --platform=node --format=esm --outfile=dist-lib/node.js --packages=external && tsc -p tsconfig.lib.json",

69 "build:cli": "npm run build:snippets && npm run bundle:stdlib && esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist-cli/cli.js --packages=external --loader:.wasm=file",

70 "build:graphics": "esbuild src/graphics-lib.ts --bundle --platform=browser --format=esm --outfile=dist-graphics/index.js --external:react --external:react-dom --external:react/jsx-runtime --external:h5wasm --jsx=automatic && tsc -p tsconfig.graphics.json",

71 "install": "true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L71

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L71

72 "build:addon": "node-gyp rebuild",

73 "format": "prettier --write .",

74 "format:check": "prettier --check .",

75 "lint": "eslint .",

76 "typecheck": "tsc -b",

77 "preview": "vite preview",

78 "test": "vitest run",

79 "test:coverage": "vitest run --coverage",

80 "test:coverage:all": "bash scripts/coverage-all.sh",

81 "test:scripts": "bash numbl_test_scripts/run_all.sh",

82 "jit-parity": "node jit_parity/run.mjs",

83 "test:browser": "playwright test",

84 "build:wasm": "bash numbl_test_scripts/build_wasm.sh",

85 "update-readme": "tsx scripts/update-readme-usage.ts",

86 "check-readme": "tsx scripts/update-readme-usage.ts --check",

87 "bump": "tsx scripts/bump-version.ts",

88 "prepublishOnly": "npm run build:lib && npm run build:browser && npm run build:graphics && npm run build:cli && npm run build:plot-viewer && npm run build:site-viewer",

89 "prepare": "husky",

90 "build:browser": "npm run build:snippets && npm run bundle:stdlib && tsx scripts/build_browser.ts"

91 },

dist-lib/node.jsView file

Lines 1-40javascript

1// src/cli-fileio.ts

2import {

3 openSync,

4 closeSync,

5 readSync,

6 writeSync,

7 readFileSync as readFileSync2,

8 writeFileSync,

9 statSync as statSync2,

10 fstatSync,

dist-lib/lib.jsView file

64173}; L64174: const factory = new Function( L64175: "RTV",

High

Eval

Package source references dynamic code evaluation.

dist-lib/lib.jsView on unpkg · L64173

dist-browser/browser.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist-browser/browser.js: var worker_code_default = 'var __defProp = Object.defineProperty;\nvar __export = (target, all2) => {\n for (var name in all2)\n __defProp(target, name, { get: all2[name], enum... writeFile(path, content) { this.post({ type: "writeFile", path, content });

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist-browser/browser.jsView on unpkg

dist-cli/cli.jsView file

16}); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

dist-cli/cli.jsView on unpkg · L16

•matchType = previous_version_dangerous_delta matchedPackage = numbl@0.4.12 matchedIdentity = npm:bnVtYmw:0.4.12 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist-cli/cli.jsView on unpkg

16Cross-file remote execution chain: dist-cli/cli.js spawns dist-graphics/index.js; helper contains network access plus dynamic code execution. L16: }); L17: import { createServer as createServer2 } from "http"; L18: import { spawn } from "child_process"; L19: import { mkdtemp, mkdir, writeFile, rm } from "fs/promises"; ... L27: }); L28: child.stdout?.on("data", (d) => { L29: output += d.toString(); ... L33: try { L34: const info = JSON.parse(output.trim()); L35: resolve3(!!info.nativeAddon); ... L51: res.writeHead(status, { "Content-Type": "application/json" }); L52: res.end(JSON.stringify(data));

dist-site-viewer/assets/qhull-DM50poqF.wasmView file

•path = dist-site-viewer/assets/qhull-DM50poqF.wasm kind = wasm_module sizeBytes = 388780 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist-site-viewer/assets/qhull-DM50poqF.wasmView on unpkg

binding.gypView file

•path = binding.gyp kind = build_helper sizeBytes = 3080 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

binding.gypView on unpkg

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView file

•path = dist-site-viewer/assets/hdf5_hl-C9YUKPMe.js kind = oversized_source_file sizeBytes = 4784586 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist-site-viewer/assets/hdf5_hl-C9YUKPMe.jsView on unpkg

Lines 285-325javascript

285 mkdir(dirPath) {

286 try {

287 mkdirSync(expandTilde(dirPath), { recursive: true });

288 return true;

289 } catch {

290 return false;

291 }

292 }

293 tempdir() {

294 return tmpdir();

295 }

296 userpath() {

297 return join2(homedir(), ".numbl");

298 }

299 websave(url, filename, options) {

300 const dest = expandTilde(filename);

301 const timeoutMs = options?.timeout ? Math.round(options.timeout * 1e3) : 3e4;

302 const fetchOpts = buildFetchOptions(options);

303 const script = `

304 const ac = new AbortController();

305 const t = setTimeout(() => ac.abort(), ${timeoutMs});

306 fetch(${JSON.stringify(url)}, { ...${JSON.stringify(fetchOpts)}, signal: ac.signal })

307 .then(r => { clearTimeout(t); if (!r.ok) throw new Error('HTTP ' + r.status); return r.arrayBuffer(); })

308 .then(buf => require('fs').writeFileSync(${JSON.stringify(dest)}, Buffer.from(buf)))

309 .catch(e => { process.stderr.write(e.message + '\\n'); process.exit(1); });

310 `;

311 try {

312 execFileSync(process.execPath, ["-e", script], {

313 stdio: ["ignore", "ignore", "pipe"],

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist-lib/node.jsView on unpkg · L305

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist-lib/node.jsView on unpkg · L305

314 timeout: timeoutMs + 5e3

315 });

316 } catch (e) {

317 const msg = e instanceof Error && "stderr" in e ? e.stderr.toString().trim() : String(e);

318 throw new Error(`websave: failed to download ${url}: ${msg}`);

319 }

320 }

321 webread(url, options) {

322 const timeoutMs = options?.timeout ? Math.round(options.timeout * 1e3) : 3e4;

323 const fetchOpts = buildFetchOptions(options);

324 const script = `

325 const ac = new AbortController();