opencode-swarm@7.124.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

opencode-swarm@7.124.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

dist/cli/index-mkkx1a4f.jsView file

32686patternName = private_key_rsa severity = critical line = 32686 matchedText = redactTe...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli/index-mkkx1a4f.jsView on unpkg · L32686

32686patternName = private_key_rsa severity = critical line = 32686 matchedText = redactTe...---"

Critical

Secret Pattern

RSA private key in dist/cli/index-mkkx1a4f.js

dist/cli/index-mkkx1a4f.jsView on unpkg · L32686

411try { L412: const maybeGates = JSON.parse(row.gates); L413: if (maybeGates && typeof maybeGates === "object" && !Array.isArray(maybeGates)) { ... L547: bunSpawn, L548: platform: process.platform, L549: sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)), ... L559: stdin: "ignore", L560: stdout: "pipe", L561: stderr: "pipe", L562: env: { ...process.env, LC_ALL: "C" } L563: }); ... L730: dense: 0.4,

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli/index-mkkx1a4f.jsView on unpkg · L411

411Cross-file remote execution chain: dist/cli/index-mkkx1a4f.js spawns dist/cli/index-bpmtbmy9.js; helper contains network access plus dynamic code execution. L411: try { L412: const maybeGates = JSON.parse(row.gates); L413: if (maybeGates && typeof maybeGates === "object" && !Array.isArray(maybeGates)) { ... L547: bunSpawn, L548: platform: process.platform, L549: sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)), ... L559: stdin: "ignore", L560: stdout: "pipe", L561: stderr: "pipe", L562: env: { ...process.env, LC_ALL: "C" } L563: }); ... L730: dense: 0.4,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index-mkkx1a4f.jsView on unpkg · L411

411try { L412: const maybeGates = JSON.parse(row.gates); L413: if (maybeGates && typeof maybeGates === "object" && !Array.isArray(maybeGates)) { ... L547: bunSpawn, L548: platform: process.platform, L549: sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)), ... L559: stdin: "ignore", L560: stdout: "pipe", L561: stderr: "pipe", L562: env: { ...process.env, LC_ALL: "C" } L563: }); ... L730: dense: 0.4,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index-mkkx1a4f.jsView on unpkg · L411

dist/cli/index-dqh3zhhc.jsView file

2// src/background/workspace-snapshot.ts L3: import * as child_process from "child_process"; L4: import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

dist/cli/index-dqh3zhhc.jsView on unpkg · L2

dist/cli/index-8fwhhayc.jsView file

144platform: "win32", L145: mechanism: "PowerShell wrapper", L146: error: `cmd.exe probe failed: ${result.error.code}`

High

Shell

Package source references shell execution.

dist/cli/index-8fwhhayc.jsView on unpkg · L144

dist/cli/index-qd77aft9.jsView file

419{ L420: let probe = seg.replace(/^(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)+/, "").replace(/^eval(?:\s+--)?\s+["']?/, "").replace(/["']\s*$/, "").replace(/^\$\(\s*/, "").replace(/^\(\s*/, "").repl... L421: for (let i = 0;i < 4; i++) {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/index-qd77aft9.jsView on unpkg · L419

dist/lang/grammars/tree-sitter-go.wasmView file

•path = dist/lang/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lang/grammars/tree-sitter-go.wasmView on unpkg

.opencode/skills/issue-tracer/scripts/scan-deferred.shView file

•path = .opencode/skills/issue-tracer/scripts/scan-deferred.sh kind = payload_in_excluded_dir sizeBytes = 4819 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/issue-tracer/scripts/scan-deferred.shView on unpkg

•path = .opencode/skills/issue-tracer/scripts/scan-deferred.sh kind = build_helper sizeBytes = 4819 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/issue-tracer/scripts/scan-deferred.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 5150693 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

12 flagged

dist/cli/index-mkkx1a4f.jsView file

32686patternName = private_key_rsa severity = critical line = 32686 matchedText = redactTe...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/cli/index-mkkx1a4f.jsView on unpkg · L32686

32686patternName = private_key_rsa severity = critical line = 32686 matchedText = redactTe...---"

Critical

Secret Pattern

RSA private key in dist/cli/index-mkkx1a4f.js

dist/cli/index-mkkx1a4f.jsView on unpkg · L32686

411try { L412: const maybeGates = JSON.parse(row.gates); L413: if (maybeGates && typeof maybeGates === "object" && !Array.isArray(maybeGates)) { ... L547: bunSpawn, L548: platform: process.platform, L549: sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)), ... L559: stdin: "ignore", L560: stdout: "pipe", L561: stderr: "pipe", L562: env: { ...process.env, LC_ALL: "C" } L563: }); ... L730: dense: 0.4,

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/cli/index-mkkx1a4f.jsView on unpkg · L411

411Cross-file remote execution chain: dist/cli/index-mkkx1a4f.js spawns dist/cli/index-bpmtbmy9.js; helper contains network access plus dynamic code execution. L411: try { L412: const maybeGates = JSON.parse(row.gates); L413: if (maybeGates && typeof maybeGates === "object" && !Array.isArray(maybeGates)) { ... L547: bunSpawn, L548: platform: process.platform, L549: sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)), ... L559: stdin: "ignore", L560: stdout: "pipe", L561: stderr: "pipe", L562: env: { ...process.env, LC_ALL: "C" } L563: }); ... L730: dense: 0.4,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli/index-mkkx1a4f.jsView on unpkg · L411

411try { L412: const maybeGates = JSON.parse(row.gates); L413: if (maybeGates && typeof maybeGates === "object" && !Array.isArray(maybeGates)) { ... L547: bunSpawn, L548: platform: process.platform, L549: sleep: (ms) => new Promise((resolve2) => setTimeout(resolve2, ms)), ... L559: stdin: "ignore", L560: stdout: "pipe", L561: stderr: "pipe", L562: env: { ...process.env, LC_ALL: "C" } L563: }); ... L730: dense: 0.4,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index-mkkx1a4f.jsView on unpkg · L411

dist/cli/index-dqh3zhhc.jsView file

Lines 1-22javascript

1// @bun

2// src/background/workspace-snapshot.ts

3import * as child_process from "child_process";

4import { createHash } from "crypto";

High

Child Process

Package source references child process execution.

dist/cli/index-dqh3zhhc.jsView on unpkg · L2

dist/cli/index-8fwhhayc.jsView file

Lines 124-164javascript

124 const result = runnerProbe();

125 if (result.available) {

126 return {

127 status: "enabled",

128 strength: "strong",

dist/cli/index-qd77aft9.jsView file

Lines 399-439javascript

399 };

400 }

401 if (/^zip\b.*\s-m\b/i.test(seg) && /\.swarm(?:[\x5c/\s]|$)/i.

dist/lang/grammars/tree-sitter-go.wasmView file

•path = dist/lang/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 217182 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/lang/grammars/tree-sitter-go.wasmView on unpkg

.opencode/skills/issue-tracer/scripts/scan-deferred.shView file

•path = .opencode/skills/issue-tracer/scripts/scan-deferred.sh kind = payload_in_excluded_dir sizeBytes = 4819 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.opencode/skills/issue-tracer/scripts/scan-deferred.shView on unpkg

•path = .opencode/skills/issue-tracer/scripts/scan-deferred.sh kind = build_helper sizeBytes = 4819 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.opencode/skills/issue-tracer/scripts/scan-deferred.shView on unpkg

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 5150693 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg