omnirush@1.0.6: Suspicious npm security report (Warn)

Loading npm security reports…

omnirush@1.0.6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

25 flagged

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView file

Lines 1-3javascript

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);

2import*as child_process from"node:child_process";import*as crypto from"node:crypto";import*as fs from"node:fs";import*as os from"node:os";import*as path from"node:path";import*as stream from"node:stream";import*as util from"node:util";export{child_process,crypto,fs,os,path,stream,util};

High

Child Process

Package source references child process execution.

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView on unpkg · L1

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView file

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import{require_bash,require_c,require_core,require_cpp,require_csharp,require_dart,require_go,require_groovy,require_java,require_javascript,require_kotlin,require_lua,require_nix,... L3: `)||potentialValue.includes("\r")||potentialValue.includes("\0"))===!1}function parseReferrerPolicy(actualResponse){let policyHeader=(actualResponse.headersList.get("referrer-polic...

High

Shell

Package source references shell execution.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

1Cross-file remote execution chain: core/dist/bundle/chunks/chunk-CMRUVXTE.js spawns [redacted].js; helper contains network access plus dynamic code execution. L1: import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import{require_bash,require_c,require_core,require_cpp,require_csharp,require_dart,require_go,require_groovy,require_java,require_javascript,require_kotlin,require_lua,require_nix,... L3: `)||potentialValue.includes("\r")||potentialValue.includes("\0"))===!1}function parseReferrerPolicy(actualResponse){let policyHeader=(actualResponse.headersList.get("referrer-polic... ... L40: `;channels.sendHeaders.publish({request,headers:header,socket:session[kSocket]})}let shouldEndStream=body===null||contentLength===0;re

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

core/deps/photon-node/photon_rs_bg.jsView file

Lines 4195-4235javascript

4195};

4196

4197export function __wbg_setwidth_c1a7061891b71f25(arg0, arg1) {

4198 getObject(arg0).width = arg1 >>> 0;

4199};

core/dist/bundle/chunks/chunk-S7SZN6Z3.jsView file

Lines 1-3javascript

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);

2import{getSystemMessageText}from"./chunk-RCZIEVGO.js";function

core/dist/bundle/chunks/bedrock-converse-stream.jsView file

35${toHex2(hashedRequest)}`}getCanonicalPath({path}){if(this.uriEscapePath){let normalizedPathSegments=[];for(let pathSegment of path.split("/"))pathSegment?.length!==0&&pathSegment!... L36: `);return this.signString(stringToSign,{signingDate,signingRegion:region,signingService,eventStreamCredentials})}async signMessage(signableMessage,{signingDate=new Date,signingRegi... L37: For more information, please visit: `+STATIC_STABILITY_DOC_URL);let originalExpiration=credentials.originalExpiration??credentials.expiration;return{...credentials,...originalExpir... ... L50: `)||(obj["#text"]="#text"in obj?obj["#text"]+text:text);for(let child of childTags)child.tag==="__proto__"&&writeKey2(obj),child.tag in obj?Array.isArray(obj[child.tag])?obj[child.... L51: Reference: https://docs.aws.amazon.

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/dist/bundle/chunks/bedrock-converse-stream.jsView on unpkg · L35

High

Command Output Exfiltration

core/dist/bundle/chunks/kimi-coding.jsView file

Lines 1-3javascript

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);

2var __require=(x=>typeof require<

assets/extensions/omnirush/auth.jsView file

9// Endpoint contract (live-verified 2026-09-22 against L10: // https://omnirush.ai/omnirush): L11: // POST /device/authorize {device_name, platform} ... L38: L39: import { spawn } from "node:child_process"; L40: import { createHash } from "node:crypto"; ... L67: /** User-Agent of every request this module sends to the manager. */ L68: export function clientUserAgent(env = process.env) { L69: const version = clientVersion || String(env.OMNIRUSH_VERSION ?? "").trim() || "unknown"; L70: return `omnirush/${version} (${process.platform}; ${process.arch})`; L71: } ... L105: ? path.resolve(env.OMNIRUSH_DIR)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

assets/extensions/omnirush/auth.jsView on unpkg · L9

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = assets/extensions/omnirush/auth.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/auth.jsView on unpkg

core/deps/photon-node/photon_rs_bg.wasmView file

•path = core/deps/photon-node/photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

core/deps/photon-node/photon_rs_bg.wasmView on unpkg

assets/extensions/omnirush/agents-lib.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/extensions/omnirush/agents-lib.ts#virtual:normalized:round1View on unpkg

src/auto-update.jsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = src/auto-update.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auto-update.jsView on unpkg

assets/extensions/omnirush/agents-lib.tsView file

•matchType = token_shingles matchedPackage = omnirush@1.0.2 matchedPath = [redacted]-lib.ts matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/agents-lib.tsView on unpkg

assets/extensions/omnirush/capture/workspace-sync.tsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = [redacted]-sync.ts matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/capture/workspace-sync.tsView on unpkg

assets/extensions/omnirush/voice/capture.tsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = [redacted].ts matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/voice/capture.tsView on unpkg

assets/extensions/omnirush/mcp-client.bundle.jsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = assets/extensions/omnirush/mcp-client.bundle.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/mcp-client.bundle.jsView on unpkg

assets/extensions/omnirush/memory-lib.tsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = [redacted]-lib.ts matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/memory-lib.tsView on unpkg

core/dist/bundle/chunks/chunk-FUXEF6JQ.jsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = core/dist/bundle/chunks/chunk-FUXEF6JQ.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/chunk-FUXEF6JQ.jsView on unpkg

core/dist/bundle/chunks/https-proxy-agent-2VXB7436.jsView file

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = core/dist/bundle/chunks/https-proxy-agent-2VXB7436.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/https-proxy-agent-2VXB7436.jsView on unpkg

assets/extensions/omnirush/voice.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/voice.tsView on unpkg

Source & flagged code

25 flagged · loading source

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView file

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import*as child_process from"node:child_process";import*as crypto from"node:crypto";import*as fs from"node:fs";import*as os from"node:os";import*as path from"node:path";import*as s...

High

Child Process

Package source references child process execution.

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView on unpkg · L1

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView file

High

Shell

Package source references shell execution.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

•matchType = normalized_sha256 matchedPackage = omnirush@1.0.2 matchedPath = core/dist/bundle/chunks/chunk-CMRUVXTE.js matchedIdentity = npm:b21uaXJ1c2g:1.0.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg

core/deps/photon-node/photon_rs_bg.jsView file

4215export function __wbg_newnoargs_be86524d73f67598(arg0, arg1) { L4216: var ret = new Function(getStringFromWasm0(arg0, arg1)); L4217: return addHeapObject(ret);

Low

Eval

Package source references a known benign dynamic code generation pattern.

core/deps/photon-node/photon_rs_bg.jsView on unpkg · L4215

core/dist/bundle/chunks/chunk-S7SZN6Z3.jsView file

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: import{getSystemMessageText}from"./chunk-RCZIEVGO.js";function loadNodeOs(){return typeof process>"u"||!(process.versions?.node||process.versions?.bun)?null:process.getBuiltinModul...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/dist/bundle/chunks/chunk-S7SZN6Z3.jsView on unpkg · L1

core/dist/bundle/chunks/bedrock-converse-stream.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/dist/bundle/chunks/bedrock-converse-stream.jsView on unpkg · L35

High

Command Output Exfiltration

core/dist/bundle/chunks/kimi-coding.jsView file

1Source sends the broad process environment to a literal external destination. L1: import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url); L2: var __require=(x=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(x,{get:(a,b)=>(typeof require<"u"?require:a)[b]}):x)(function(x){if(typeof require<"u")return require.apply(...

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

core/dist/bundle/chunks/kimi-coding.jsView on unpkg · L1

assets/extensions/omnirush/auth.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

assets/extensions/omnirush/auth.jsView on unpkg · L9

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/auth.jsView on unpkg

core/deps/photon-node/photon_rs_bg.wasmView file

•path = core/deps/photon-node/photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

core/deps/photon-node/photon_rs_bg.wasmView on unpkg

assets/extensions/omnirush/agents-lib.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/extensions/omnirush/agents-lib.ts#virtual:normalized:round1View on unpkg

src/auto-update.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auto-update.jsView on unpkg

assets/extensions/omnirush/agents-lib.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/agents-lib.tsView on unpkg

assets/extensions/omnirush/capture/workspace-sync.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/capture/workspace-sync.tsView on unpkg

assets/extensions/omnirush/voice/capture.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/voice/capture.tsView on unpkg

assets/extensions/omnirush/mcp-client.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/mcp-client.bundle.jsView on unpkg

assets/extensions/omnirush/memory-lib.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/memory-lib.tsView on unpkg

core/dist/bundle/chunks/chunk-FUXEF6JQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/chunk-FUXEF6JQ.jsView on unpkg

core/dist/bundle/chunks/https-proxy-agent-2VXB7436.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/https-proxy-agent-2VXB7436.jsView on unpkg

assets/extensions/omnirush/voice.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/voice.tsView on unpkg

Source & flagged code

25 flagged

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView file

Lines 1-3javascript

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);

High

Child Process

Package source references child process execution.

core/dist/bundle/chunks/chunk-7ZC4UXSL.jsView on unpkg · L1

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView file

High

Shell

Package source references shell execution.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

core/dist/bundle/chunks/chunk-CMRUVXTE.jsView on unpkg · L1

core/deps/photon-node/photon_rs_bg.jsView file

Lines 4195-4235javascript

4195};

4196

4197export function __wbg_setwidth_c1a7061891b71f25(arg0, arg1) {

4198 getObject(arg0).width = arg1 >>> 0;

4199};

core/dist/bundle/chunks/chunk-S7SZN6Z3.jsView file

Lines 1-3javascript

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);

2import{getSystemMessageText}from"./chunk-RCZIEVGO.js";function

core/dist/bundle/chunks/bedrock-converse-stream.jsView file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

core/dist/bundle/chunks/bedrock-converse-stream.jsView on unpkg · L35

High

Command Output Exfiltration

core/dist/bundle/chunks/kimi-coding.jsView file

Lines 1-3javascript

1import { createRequire as __piCreateRequire } from "node:module"; const require = __piCreateRequire(import.meta.url);

2var __require=(x=>typeof require<

assets/extensions/omnirush/auth.jsView file

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

assets/extensions/omnirush/auth.jsView on unpkg · L9

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/auth.jsView on unpkg

core/deps/photon-node/photon_rs_bg.wasmView file

•path = core/deps/photon-node/photon_rs_bg.wasm kind = wasm_module sizeBytes = 1881634 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

core/deps/photon-node/photon_rs_bg.wasmView on unpkg

assets/extensions/omnirush/agents-lib.ts#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 8

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

assets/extensions/omnirush/agents-lib.ts#virtual:normalized:round1View on unpkg

src/auto-update.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/auto-update.jsView on unpkg

assets/extensions/omnirush/agents-lib.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/agents-lib.tsView on unpkg

assets/extensions/omnirush/capture/workspace-sync.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/capture/workspace-sync.tsView on unpkg

assets/extensions/omnirush/voice/capture.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/voice/capture.tsView on unpkg

assets/extensions/omnirush/mcp-client.bundle.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/mcp-client.bundle.jsView on unpkg

assets/extensions/omnirush/memory-lib.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/memory-lib.tsView on unpkg

core/dist/bundle/chunks/chunk-FUXEF6JQ.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/chunk-FUXEF6JQ.jsView on unpkg

core/dist/bundle/chunks/https-proxy-agent-2VXB7436.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

core/dist/bundle/chunks/https-proxy-agent-2VXB7436.jsView on unpkg

assets/extensions/omnirush/voice.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

assets/extensions/omnirush/voice.tsView on unpkg

omnirush@1.0.6

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code