openbucket@0.1.3: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

openbucket@0.1.3: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/server/index.jsView file

682* When no redirect matches (the common case for ordinary page loads), L683: * matchRedirect previously ran exec() on every one of those regexes — L684: * ~2ms per call, ~2992ms total self-time in profiles.

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L682

dist/cli/main.jsView file

150execPath: process.execPath, L151: execArgv: [...process.execArgv], L152: pid: process.pid,

High

Shell

Package source references shell execution.

dist/cli/main.jsView on unpkg · L150

dist/server/ssr/__vite_rsc_assets_manifest.jsView file

1export default { L2: "bootstrapScriptContent": "import(\"/assets/index-C8R4CT-B.js\")", L3: "clientReferenceDeps": {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/ssr/__vite_rsc_assets_manifest.jsView on unpkg · L1

dist/daemon/store.jsView file

19const BUCKET_PATTERN = /^(?!\d{1,3}(?:\.\d{1,3}){3}$)(?!.*\.\.)(?!.*\.-)(?!.*-\.)(?!-)(?!.*-$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/; L20: const PROCESS_INSTANCE_ID = randomBytes(18).toString("base64url"); L21: const ACTIVE_LOCKS = new Set(); ... L41: } L42: if (process.platform === "win32" && segments.some((part) => /[<>:"|?*]/.test(part) || /[. ]$/.test(part) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i.test(part))) { L43: throw new StoreError("InvalidObjectName", "The object key cannot be represented safely on this filesystem."); ... L137: nodeId: randomUUID(), L138: nodeName: nodeName?.trim() || `openbucket-${process.env.COMPUTERNAME || process.env.HOSTNAME || "node"}`, L139: createdAt: now, ... L159: const nonce = randomBytes(18).toString("base64url"); L160: const payload =

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon/store.jsView on unpkg · L19

dist/server/assets/service-BlSD6pGH.jsView file

4import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

4Cross-file remote execution chain: dist/server/assets/service-BlSD6pGH.js spawns dist/server/index.js; helper contains network access plus dynamic code execution. L4: import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

examples/python/upload.pyView file

•path = examples/python/upload.py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/python/upload.pyView on unpkg

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View file

•path = dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2 kind = high_entropy_blob sizeBytes = 16540 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View on unpkg

dist/cli/auth-session.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openbucket@0.1.1 matchedIdentity = npm:b3BlbmJ1Y2tldA:0.1.1 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/auth-session.jsView on unpkg

Source & flagged code

9 flagged

dist/server/index.jsView file

682* When no redirect matches (the common case for ordinary page loads), L683: * matchRedirect previously ran exec() on every one of those regexes — L684: * ~2ms per call, ~2992ms total self-time in profiles.

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L682

dist/cli/main.jsView file

Lines 130-170javascript

130 }

131 }

132 }

133 else if (!childClosed && child.exitCode === null && child.signalCode === null) {

134 child.kill("SIGKILL");

135 }

136 await waitForChildClose(child, 2_000);

137}

138function defaultIO(overrides = {}) {

139 return {

140 stdout: process.stdout,

141 stderr: process.stderr,

142 env: process.env,

143 cwd: () => process.cwd(),

144 homedir,

145 fetch: globalThis.fetch.bind(globalThis),

146 spawn: (command, args, options) => nodeSpawn(command, [...args], options),

147 terminateProcessTree: terminateDetachedProcessTree,

148 sleep: (milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds)),

149 platform: process.platform,

150 execPath: process.execPath,

151 execArgv: [...process.execArgv],

152 pid: process.pid,

High

Shell

Package source references shell execution.

dist/cli/main.jsView on unpkg · L150

153 cliPath: fileURLToPath(import.meta.url),

154 prompt: defaultAuthPrompt,

155 readStdin: readAuthStdin,

156 ...overrides,

157 };

158}

159function writeLine(writer, value = "") {

160 writer.write(`${value}\n`);

161}

162function optionKey(name) {

163 return name.replace(/-([a-z])/g, (_match, character) => character.toUpperCase());

164}

165function parseOptions(tokens, valueOptions, flagOptions) {

166 const values = new Set(valueOptions);

167 const flags = new Set(flagOptions);

168 const options = {};

169 const positionals = [];

170 let positionalOnly = false;

dist/server/ssr/__vite_rsc_assets_manifest.jsView file

Lines 1-21javascript

1export default {

2 "bootstrapScriptContent": "import(\"/assets/index-C8R4CT-B.js\")",

3 "clientReferenceDeps": {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/ssr/__vite_rsc_assets_manifest.jsView on unpkg · L1

4

dist/daemon/store.jsView file

Lines 1-39javascript

1import { createHash, randomBytes, randomUUID } from "node:crypto";

2import { createReadStream, createWriteStream } from "node:fs";

3import { appendFile, lstat, mkdir, open as openFile, opendir, readFile, realpath, rename, rm, rmdir, stat, statfs, writeFile, } from "node:fs/promises";

4import { hostname } from

dist/server/assets/service-BlSD6pGH.jsView file

4import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

4Cross-file remote execution chain: dist/server/assets/service-BlSD6pGH.js spawns dist/server/index.js; helper contains network access plus dynamic code execution. L4: import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

examples/python/upload.pyView file

•path = examples/python/upload.py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/python/upload.pyView on unpkg

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View file

•path = dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2 kind = high_entropy_blob sizeBytes = 16540 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View on unpkg

dist/cli/auth-session.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openbucket@0.1.1 matchedIdentity = npm:b3BlbmJ1Y2tldA:0.1.1 similarity = 0.792 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/auth-session.jsView on unpkg