openship@0.1.9: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

openship@0.1.9: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged

dist/index.jsView file

Lines 663-703javascript

663 defaultPort: 8080,

664 defaultBuildCommand: "gradle build -x test",

665 defaultStartCommand: "java -jar build/libs/*.jar",

666 productionPaths: ["build/libs"],

667 defaultBuildStrategy: "local",

668 // Gradle-based; bare-metal builds need `gradle` ensured (or the `./gradlew`

669 // wrapper, which the detector prefers when present).

670 requiredTools: ["java", "javac", "gradle"],

671 detection: {

672 rootMarkers: ["build.gradle.kts", "build.gradle"],

673 contentPatterns: {

674 "build.gradle.kts": "kotlin\\s*\\(|org\\.jetbrains\\.kotlin",

675 "build.gradle": "org\\.jetbrains\\.kotlin|kotlin[- ]"

676 }

677 }

678 },

679 // ── C# / .NET ──────────────────────────────────────────────────────────────

680 dotnet: {

681 name: ".NET",

682 language: "csharp",

683 category: "backend",

684 // Build runs `dotnet publish -c Release -o publish`, so the artifact is ./publish.

685 outputDirectory: "publish",

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L683

686 defaultPort: 5e3,

687 defaultBuildCommand: "dotnet publish -c Release -o publish",

688 // .NET reads ASPNETCORE_URLS (not $PORT) and defaults to :8080, so bind it

689 // explicitly to the injected port. The detector rewrites `app.dll` to the

690 // real assembly name (from the .csproj); `app` is the fallback.

691 defaultStartCommand: "ASPNETCORE_URLS=http://0.0.0.0:$PORT dotnet publish/app.dll",

692 productionPaths: ["publish"],

693 detection: {

694 // .csproj/.fsproj/.sln are detected by suffix; rootMarkers is decorative

695 // here since the suffix-match lives in stack-detector.

696 }

697 },

698 blazor: {

699 name: "Blazor",

700 language: "csharp",

701 // Blazor WebAssembly compiles to a static bundle under publish/wwwroot —

702 // it's served as files, not a running server (Blazor Server folds into `dotnet`).

703 category: "static",

Lines 1991-2031javascript

1991 if (!caps.selfHosted) {

1992 throw new ApiError(

1993 "This command is only available on a self-hosted Openship instance, not on Openship Cloud.",

1994 400,

1995 null

1996 );

1997 }

Lines 2126-2211javascript

2126 chalk4.yellow(`

2127 Heads up: the local API at ${apiUrl} isn't responding yet.`) + chalk4.dim("\n Start it with `openship setup`, or use --cloud.\n")

2128 );

2129 }

2130 }

2131 try {

dist/server/pglite/pglite.wasmView file

•path = dist/server/pglite/pglite.wasm kind = wasm_module sizeBytes = 8861740 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

dist/server/pglite/pglite.wasmView on unpkg

dist/server/index.jsView file

•path = dist/server/index.js kind = oversized_source_file sizeBytes = 11580504 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/server/index.jsView on unpkg