ohmycode@1.0.8: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

ohmycode@1.0.8: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/setup-startup.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

bin/setup-startup.jsView file

1import { exec } from 'child_process'; L2: import fs from 'fs';

High

Child Process

Package source references child process execution.

bin/setup-startup.jsView on unpkg · L1

1Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L1: import { exec } from 'child_process'; L2: import fs from 'fs'; ... L5: L6: const homeDir = os.homedir(); L7: ... L14: const vbsPath = path.join(omcDir, 'ohmycode-silent.vbs'); L15: const appData = process.env.APPDATA || path.join(homeDir, 'AppData', 'Roaming'); L16: const cmdPath = path.join(appData, 'npm', 'ohmycode.cmd');

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/setup-startup.jsView on unpkg · L1

1Trigger-reachable persistence chain: scripts.postinstall -> bin/setup-startup.js L1: import { exec } from 'child_process'; L2: import fs from 'fs'; ... L5: L6: const homeDir = os.homedir(); L7: ... L14: const vbsPath = path.join(omcDir, 'ohmycode-silent.vbs'); L15: const appData = process.env.APPDATA || path.join(homeDir, 'AppData', 'Roaming'); L16: const cmdPath = path.join(appData, 'npm', 'ohmycode.cmd');

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

bin/setup-startup.jsView on unpkg · L1

1import { exec } from 'child_process'; L2: import fs from 'fs'; ... L5: L6: const homeDir = os.homedir(); L7: ... L14: const vbsPath = path.join(omcDir, 'ohmycode-silent.vbs'); L15: const appData = process.env.APPDATA || path.join(homeDir, 'AppData', 'Roaming'); L16: const cmdPath = path.join(appData, 'npm', 'ohmycode.cmd');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/setup-startup.jsView on unpkg · L1

build/server/chunks/_server.ts-LO208n8J.jsView file

7try { L8: const output = execFileSync("powershell", [ L9: "-NoProfile",

High

Shell

Package source references shell execution.

build/server/chunks/_server.ts-LO208n8J.jsView on unpkg · L7

build/server/index.jsView file

37/** L38: * @template {{ tracing: { enabled: boolean, root: import('@opentelemetry/api').Span, current: import('@opentelemetry/api').Span } }} T L39: * @param {T} event_like

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/server/index.jsView on unpkg · L37

bin/ohmycode.jsView file

2Cross-file remote execution chain: bin/ohmycode.js spawns build/server/index.js; helper contains network access plus dynamic code execution. L2: L3: import { spawn, exec } from 'child_process'; L4: import path from 'path'; ... L11: L12: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L13: const serverPath = path.resolve(__dirname, '../build/index.js'); ... L21: const args = process.argv.slice(2); L22: let port = process.env.PORT || 9966; L23: ... L32: L33: console.log(`\x1b[35m%s\x1b[0m`, `🌼 ohmycode starting on http://localhost:${port}...`); L34:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/ohmycode.jsView on unpkg · L2

build/client/_app/immutable/nodes/2.CwLYsk-Z.jsView file

10} L11: `,document.head.appendChild(e)}let a=!1,o;window.addEventListener(`scroll`,()=>{a=!0,clearTimeout(o),o=setTimeout(()=>{a=!1},200)},{passive:!0});let s=()=>{if(a)return;let e=window... L12: @keyframes fmr-fade-in { from { opacity: 0; } to { opacity: 1; } }

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

build/client/_app/immutable/nodes/2.CwLYsk-Z.jsView on unpkg · L10

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 70 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/2.CwLYsk-Z.js.gzView file

•path = build/client/_app/immutable/nodes/2.CwLYsk-Z.js.gz kind = high_entropy_blob sizeBytes = 46777 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/2.CwLYsk-Z.js.gzView on unpkg

build/index.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/index.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 4-44json

4 "version": "1.0.8",

5 "description": "Modern, playful, and colorful interactive Kanban for developers",

6 "type": "module",

7 "files": [

8 "build",

9 "bin"

10 ],

11 "bin": {

12 "ohmycode": "./bin/ohmycode.js"

13 },

14 "scripts": {

15 "dev": "vite dev",

16 "build": "vite build",

17 "preview": "vite preview",

18 "prepare": "svelte-kit sync || echo ''",

19 "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",

20 "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",

21 "lint": "prettier --check . && eslint .",

22 "format": "prettier --write .",

23 "prepublishOnly": "npm run build",

24 "postinstall": "node bin/setup-startup.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

25 },

26 "devDependencies": {

27 "@eslint/compat": "^2.0.4",

28 "@eslint/js": "^10.0.1",

29 "@sveltejs/adapter-node": "^5.5.4",

30 "@sveltejs/kit": "^2.57.0",

31 "@sveltejs/vite-plugin-svelte": "^7.0.0",

32 "@tailwindcss/vite": "^4.2.2",

33 "@types/adm-zip": "^0.5.8",

34 "@types/node": "^24",

35 "daisyui": "^5.5.19",

36 "eslint": "^10.2.0",

37 "eslint-config-prettier": "^10.1.8",

38 "eslint-plugin-svelte": "^3.17.0",

39 "globals": "^17.4.0",

40 "prettier": "^3.8.1",

41 "prettier-plugin-svelte": "^3.5.1",

42 "prettier-plugin-tailwindcss": "^0.7.2",

43 "svelte": "^5.55.2",

44 "svelte-check": "^4.4.6",

bin/setup-startup.jsView file

Lines 1-21javascript

1import { exec } from 'child_process';

2import fs from 'fs';

High

Child Process

Package source references child process execution.

bin/setup-startup.jsView on unpkg · L1

3import path from 'path';

4import os

build/server/chunks/_server.ts-LO208n8J.jsView file

Lines 1-27javascript

1import { j as json } from './index-De89J4_m.js';

2import { execFileSync } from 'child_process';

3import './index-DBqjc0Yf.js';

4

5//#region src/routes/api/git/picker/native/+server.ts

6var

build/server/index.jsView file

Lines 17-57javascript

17function override(paths) {

18 base = paths.base;

19 assets = paths.assets;

20}

21function reset() {

22 base = initial.base;

23

bin/ohmycode.jsView file

Lines 1-22javascript

1#! /usr/bin/env node

2

3import { spawn, exec } from 'child_process';

4import path from 'path';

5import { fileURLToPath } from 'url';

6import fs from

build/client/_app/immutable/nodes/2.CwLYsk-Z.jsView file

10} L11: `,document.head.appendChild(e)}let a=!1,o;window.addEventListener(`scroll`,()=>{a=!0,clearTimeout(o),o=setTimeout(()=>{a=!1},200)},{passive:!0});let s=()=>{if(a)return;let e=window... L12: @keyframes fmr-fade-in { from { opacity: 0; } to { opacity: 1; } }

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

build/client/_app/immutable/nodes/2.CwLYsk-Z.jsView on unpkg · L10

build/client/robots.txt.brView file

•path = build/client/robots.txt.br kind = compressed_blob sizeBytes = 70 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

build/client/robots.txt.brView on unpkg

build/client/_app/immutable/nodes/2.CwLYsk-Z.js.gzView file

•path = build/client/_app/immutable/nodes/2.CwLYsk-Z.js.gz kind = high_entropy_blob sizeBytes = 46777 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

build/client/_app/immutable/nodes/2.CwLYsk-Z.js.gzView on unpkg

build/index.jsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

build/index.jsView on unpkg