openbucket@0.1.5: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

openbucket@0.1.5: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

9 flagged · loading source

dist/server/index.jsView file

682* When no redirect matches (the common case for ordinary page loads), L683: * matchRedirect previously ran exec() on every one of those regexes — L684: * ~2ms per call, ~2992ms total self-time in profiles.

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L682

dist/cli/main.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = openbucket@0.1.3 matchedIdentity = npm:b3BlbmJ1Y2tldA:0.1.3 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/main.jsView on unpkg

149execPath: process.execPath, L150: execArgv: [...process.execArgv], L151: pid: process.pid,

High

Shell

Package source references shell execution.

dist/cli/main.jsView on unpkg · L149

dist/server/ssr/__vite_rsc_assets_manifest.jsView file

1export default { L2: "bootstrapScriptContent": "import(\"/assets/index-UXH_S-JH.js\")", L3: "clientReferenceDeps": {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/ssr/__vite_rsc_assets_manifest.jsView on unpkg · L1

dist/daemon/store.jsView file

19const BUCKET_PATTERN = /^(?!\d{1,3}(?:\.\d{1,3}){3}$)(?!.*\.\.)(?!.*\.-)(?!.*-\.)(?!-)(?!.*-$)[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/; L20: const PROCESS_INSTANCE_ID = randomBytes(18).toString("base64url"); L21: const ACTIVE_LOCKS = new Set(); ... L41: } L42: if (process.platform === "win32" && segments.some((part) => /[<>:"|?*]/.test(part) || /[. ]$/.test(part) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/i.test(part))) { L43: throw new StoreError("InvalidObjectName", "The object key cannot be represented safely on this filesystem."); ... L137: nodeId: randomUUID(), L138: nodeName: nodeName?.trim() || `openbucket-${process.env.COMPUTERNAME || process.env.HOSTNAME || "node"}`, L139: createdAt: now, ... L159: const nonce = randomBytes(18).toString("base64url"); L160: const payload =

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/daemon/store.jsView on unpkg · L19

dist/server/assets/service-BlSD6pGH.jsView file

4import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

4Cross-file remote execution chain: dist/server/assets/service-BlSD6pGH.js spawns dist/server/index.js; helper contains network access plus dynamic code execution. L4: import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

examples/python/upload.pyView file

•path = examples/python/upload.py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/python/upload.pyView on unpkg

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View file

•path = dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2 kind = high_entropy_blob sizeBytes = 16540 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View on unpkg

Source & flagged code

9 flagged

dist/server/index.jsView file

682* When no redirect matches (the common case for ordinary page loads), L683: * matchRedirect previously ran exec() on every one of those regexes — L684: * ~2ms per call, ~2992ms total self-time in profiles.

High

Child Process

Package source references child process execution.

dist/server/index.jsView on unpkg · L682

dist/cli/main.jsView file

Lines 129-169javascript

129 }

130 }

131 }

132 else if (!childClosed && child.exitCode === null && child.signalCode === null) {

133 child.kill("SIGKILL");

134 }

135 await waitForChildClose(child, 2_000);

136}

137function defaultIO(overrides = {}) {

138 return {

139 stdout: process.stdout,

140 stderr: process.stderr,

141 env: process.env,

142 cwd: () => process.cwd(),

143 homedir,

144 fetch: globalThis.fetch.bind(globalThis),

145 spawn: (command, args, options) => nodeSpawn(command, [...args], options),

146 terminateProcessTree: terminateDetachedProcessTree,

147 sleep: (milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds)),

148 platform: process.platform,

149 execPath: process.execPath,

150 execArgv: [...process.execArgv],

151 pid: process.pid,

High

Shell

Package source references shell execution.

dist/cli/main.jsView on unpkg · L149

152 cliPath: fileURLToPath(import.meta.url),

153 prompt: defaultAuthPrompt,

154 readStdin: readAuthStdin,

155 ...overrides,

156 };

157}

158function writeLine(writer, value = "") {

159 writer.write(`${value}\n`);

160}

161function optionKey(name) {

162 return name.replace(/-([a-z])/g, (_match, character) => character.toUpperCase());

163}

164function parseOptions(tokens, valueOptions, flagOptions) {

165 const values = new Set(valueOptions);

166 const flags = new Set(flagOptions);

167 const options = {};

168 const positionals = [];

169 let positionalOnly = false;

•matchType = previous_version_dangerous_delta matchedPackage = openbucket@0.1.3 matchedIdentity = npm:b3BlbmJ1Y2tldA:0.1.3 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/main.jsView on unpkg

dist/server/ssr/__vite_rsc_assets_manifest.jsView file

Lines 1-21javascript

1export default {

2 "bootstrapScriptContent": "import(\"/assets/index-UXH_S-JH.js\")",

3 "clientReferenceDeps": {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/ssr/__vite_rsc_assets_manifest.jsView on unpkg · L1

4

dist/daemon/store.jsView file

Lines 1-39javascript

1import { createHash, randomBytes, randomUUID } from "node:crypto";

2import { createReadStream, createWriteStream } from "node:fs";

3import { appendFile, lstat, mkdir, open as openFile, opendir, readFile, realpath, rename, rm, rmdir, stat, statfs, writeFile, } from "node:fs/promises";

4import { hostname } from

dist/server/assets/service-BlSD6pGH.jsView file

4import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

4Cross-file remote execution chain: dist/server/assets/service-BlSD6pGH.js spawns dist/server/index.js; helper contains network access plus dynamic code execution. L4: import * as m$14 from "fs"; L5: import * as m$13 from "http"; L6: import * as m$12 from "process"; ... L9: import * as m$9 from "util"; L10: import * as m$8 from "dns"; L11: import * as m$7 from "url"; ... L15: import * as m$3 from "tls"; L16: import * as m$2 from "child_process"; L17: import * as m$1 from "os"; ... L81: if (fatal) { L82: TextDecoderFatal ??= new TextDecoder("utf8", { fatal: true }); L83: try {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/server/assets/service-BlSD6pGH.jsView on unpkg · L4

examples/python/upload.pyView file

•path = examples/python/upload.py kind = build_helper sizeBytes = 2264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/python/upload.pyView on unpkg

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View file

•path = dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2 kind = high_entropy_blob sizeBytes = 16540 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/client/assets/_vinext_fonts/geist-8ac0455e797f/geist-001175b1.woff2View on unpkg