omnirush@1.0.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

omnirush@1.0.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

15 flagged · loading source

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView file

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import*as child_process from"node:child_process";import*as crypto from"node:crypto";import*as fs from"node:fs";import*as os from"node:os";import*as path from"node:path";import*as s...

High

Child Process

Package source references child process execution.

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView on unpkg · L1

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView file

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import{require_bash,require_c,require_core,require_cpp,require_csharp,require_dart,require_go,require_groovy,require_java,require_javascript,require_kotlin,require_lua,require_nix,... L3: `)||potentialValue.includes("\r")||potentialValue.includes("\0"))===!1}function parseReferrerPolicy(actualResponse){let policyHeader=(actualResponse.headersList.get("referrer-polic...

High

Shell

Package source references shell execution.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

1Cross-file remote execution chain: core/dist/bundle/chunks/chunk-CMRUVXTE.js spawns [redacted].js; helper contains network access plus dynamic code execution. L1: import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import{require_bash,require_c,require_core,require_cpp,require_csharp,require_dart,require_go,require_groovy,require_java,require_javascript,require_kotlin,require_lua,require_nix,... L3: `)||potentialValue.includes("\r")||potentialValue.includes("\0"))===!1}function parseReferrerPolicy(actualResponse){let policyHeader=(actualResponse.headersList.get("referrer-polic... ... L40: `;channels.sendHeaders.publish({request,headers:header,socket:session[kSocket]})}let shouldEndStream=body===null||contentLength===0;re

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

core/deps/photon-node/photon_rs_bg.jsView file

4215export function __wbg_newnoargs_be86524d73f67598(arg0, arg1) { L4216: var ret = new Function(getStringFromWasm0(arg0, arg1)); L4217: return addHeapObject(ret);

Low

Eval

Package source references a known benign dynamic code generation pattern.

core/deps/photon-node/photon_rs_bg.jsView on unpkg · L4215

core/dist/bundle/chunks/chunk-S7SZN6Z3.jsView file

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import{getSystemMessageText}from"./chunk-RCZIEVGO.js";function loadNodeOs(){return typeof process>"u"||!(process.versions?.node||process.versions?.bun)?null:process.getBuiltinModul...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/dist/bundle/chunks/chunk-S7SZN6Z3.jsView on unpkg · L1

core/dist/bundle/chunks/bedrock-converse-stream.jsView file

35${toHex2(hashedRequest)}`}getCanonicalPath({path}){if(this.uriEscapePath){let normalizedPathSegments=[];for(let pathSegment of path.split("/"))pathSegment?.length!==0&&pathSegment!... L36: `);return this.signString(stringToSign,{signingDate,signingRegion:region,signingService,eventStreamCredentials})}async signMessage(signableMessage,{signingDate=new Date,signingRegi... L37: For more information, please visit: `+STATIC_STABILITY_DOC_URL);let originalExpiration=credentials.originalExpiration??credentials.expiration;return{...credentials,...originalExpir... ... L50: `)||(obj["#text"]="#text"in obj?obj["#text"]+text:text);for(let child of childTags)child.tag==="__proto__"&&writeKey2(obj),child.tag in obj?Array.isArray(obj[child.tag])?obj[child.... L51: Reference: https://docs.aws.amazon.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/dist/bundle/chunks/bedrock-converse-stream.jsView on unpkg · L35

35${toHex2(hashedRequest)}`}getCanonicalPath({path}){if(this.uriEscapePath){let normalizedPathSegments=[];for(let pathSegment of path.split("/"))pathSegment?.length!==0&&pathSegment!... L36: `);return this.signString(stringToSign,{signingDate,signingRegion:region,signingService,eventStreamCredentials})}async signMessage(signableMessage,{signingDate=new Date,signingRegi... L37: For more information, please visit: `+STATIC_STABILITY_DOC_URL);let originalExpiration=credentials.originalExpiration??credentials.expiration;return{...credentials,...originalExpir... ... L50: `)||(obj["#text"]="#text"in obj?obj["#text"]+text:text);for(let child of childTags)child.tag==="__proto__"&&writeKey2(obj),child.tag in obj?Array.isArray(obj[child.tag])?obj[child.... L51: Reference: https://docs.aws.amazon.

High

Command Output Exfiltration

core/dist/bundle/chunks/kimi-coding.jsView file

1Source sends the broad process environment to a literal external destination. L1: import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: var __require=(x=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(x,{get:(a,b)=>(typeof require<"u"?require:a)[b]}):x)(function(x){if(typeof require<"u")return require.apply(...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

core/dist/bundle/chunks/kimi-coding.jsView on unpkg · L1

assets/extensions/omnirush/auth.jsView file

9// Endpoint contract (live-verified 2026-09-22 against L10: // https://omnirush.ai/omnirush): L11: // POST /device/authorize {device_name, platform} ... L38: L39: import { spawn } from "node:child_process"; L40: import { createHash } from "node:crypto"; ... L67: /** User-Agent of every request this module sends to the manager. */ L68: export function clientUserAgent(env = process.env) { L69: const version = clientVersion || String(env.OMNIRUSH_VERSION ?? "").trim() || "unknown"; L70: return `omnirush/${version} (${process.platform}; ${process.arch})`; L71: } ... L105: ? path.resolve(env.OMNIRUSH_DIR)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

assets/extensions/omnirush/auth.jsView on unpkg · L9

core/deps/photon-node/photon_rs_bg.wasmView file

•path = core/deps/photon-node/photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

core/deps/photon-node/photon_rs_bg.wasmView on unpkg

assets/extensions/omnirush/engine-messages.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 6

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/extensions/omnirush/engine-messages.ts#virtual:normalized:round1View on unpkg

core/dist/core/export-html/vendor/highlight.min.jsView file

•matchType = normalized_sha256 matchedPackage = @phi-code-admin/phi-code@0.99.0 matchedPath = dist/core/export-html/vendor/highlight.min.js matchedIdentity = npm:[redacted]:0.99.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/core/export-html/vendor/highlight.min.jsView on unpkg

core/dist/core/export-html/vendor/marked.min.jsView file

•matchType = normalized_sha256 matchedPackage = @phi-code-admin/phi-code@0.99.0 matchedPath = dist/core/export-html/vendor/marked.min.js matchedIdentity = npm:[redacted]:0.99.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/core/export-html/vendor/marked.min.jsView on unpkg