Loading npm security reports…

orbitchat@3.11.11: Suspicious npm security report (Warn) | LPM Firewall

registry / orbitchat / 3.11.11

orbitchat@3.11.11

A standalone chat application for ORBIT that can be installed as an npm package and run as a CLI tool. All API communication is routed through a built-in Express proxy that maps adapter names to backend API keys, so **no secrets ever reach the browser**.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 22 finding(s) at 97.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

NoLicense

scanned 72 file(s), 6.22 MB of source, external domains: 169.254.169.254, auth0.com, bit.ly, chevrotain.io, en.wikipedia.org, github.com, jquery.org, langium.org, lodash.com, login.microsoftonline.com, openjsf.org, paulrosen.github.io, react.dev, redux-toolkit.js.org, redux.js.org, schemas.microsoft.com, schemas.openxmlformats.org, stuk.github.io, tldrlegal.com, underscorejs.org, www.w3.org

Source & flagged code

10 flagged

dist/assets/vendor-auth-aD_bwYde.jsView file

Lines 1-6javascript

1import{r as L,R as Sl}from"./vendor-react-BbEy7z12.js";var gs=function(r,e){return gs=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(t,n){t.__proto__=n}||function(t,n){for(var o in n)Object.prototype.hasOwnProperty.call(n,o)&&(t[o]=n[o])},gs(r,e)};function tp(r,e){if(typeof e!="function"&&e!==null)throw new TypeError("Class extends value "+String(e)+" is not a constructor or null");gs(r,e);function t(){this.constructor=r}r.prototype=e===null?Object.create(e):(t.prototype=e.prototype,new t)}var le=function(){return le=Object.assign||function(e){for(var t,n=1,o=arguments.length; ...

2In order to be iterable, non-array objects must have a [Symbol.iterator]() method.`)})()}function op(r){return function(){return new Sr(r.apply(this,arguments))}}function Sr(r){var e,t;function n(i,s){try{var a=r[i](s),c=a.value,l=c instanceof El;Promise.resolve(l?c.v:c).then(function(h){if(l){var d=i==="return"&&c.k?i:"next";if(!c.k||h.done)return n(d,h);h=r[d](h).value}o(!!a.done,h)},function(h){n("throw",h)})}catch(h){o(2,h)}}function o(i,s){i===2?e.reject(s):e.resolve({value:s,done:i}),(e=e.next)?n(e.key,e.arg):t=null}this._invoke=function(i,s){return new Promise(function(a,c){var l={key:i ...

3`,10)+1,s=o.substring(i)+(n?"//# sourceMappingURL="+n:""),a=new Blob([s],{type:"application/javascript"});return URL.createObjectURL(a)}var zc,Wc,Jc,Li,Up=(zc="Lyogcm9sbHVwLXBsdWdpbi13ZWItd29ya2VyLWxvYWRlciAqLwohZnVuY3Rpb24oKXsidXNlIHN0cmljdCI7ZnVuY3Rpb24gZShlLHQpeyhudWxsPT10fHx0PmUubGVuZ3RoKSYmKHQ9ZS5sZW5ndGgpO2Zvcih2YXIgcj0wLG89QXJyYXkodCk7cjx0O3IrKylvW3JdPWVbcl07cmV0dXJuIG99ZnVuY3Rpb24gdCh0LHIpe3JldHVybiBmdW5jdGlvbihlKXtpZihBcnJheS5pc0FycmF5KGUpKXJldHVybiBlfSh0KXx8ZnVuY3Rpb24oZSx0KXt2YXIgcj1udWxsPT1lP251bGw6InVuZGVmaW5lZCIhPXR5cGVvZiBTeW1ib2wmJmVbU3ltYm9sLml0ZXJhdG9yXXx8ZVsiQEBpdGVyYXRvciJd ..

4 auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.

5 `)})(),this.lockManager=(Ui||(Ui=up()),Ui),e.cache&&e.cacheLocation&&console.warn("Both `cache` and `cacheLocation` options have been specified in the Auth0Client configuration; ignoring `cacheLocation` and using `cache`."),e.cache)n=e.cache;else{if(t=e.cacheLocation||Dc,!Gc(t))throw new Error('Invalid cache location "'.concat(t,'"'));n=Gc(t)()}var o;this.httpTimeoutMs=e.httpTimeoutInSeconds?1e3*e.httpTimeoutInSeconds:ms,this.cookieStorage=e.legacySameSiteCookie===!1?Mn:Np,this.orgHintCookieName=(o=this.options.clientId,"auth0.".concat(o,".organization_hint")),this.isAuthenticatedCookieNam ...

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L1

Long lines were clipped for display.

dist/assets/docx-preview-DehBmhog.jsView file

Lines 1-31javascript

1import{c as Rt,g as _e}from"./vendor-react-BbEy7z12.js";function Mt(c){throw new Error('Could not dynamically require "'+c+'". Please configure the dynamicRequireTargets or/and ignoreDynamicRequires option of @rollup/plugin-commonjs appropriately for this require call to work.')}

dist/assets/vendor-syntax-INF7-xC_.jsView file

12* @public L13: */var a=(function(r){var n=/(?:^|\s)lang(?:uage)?-([\w-]+)(?=\s|$)/i,i=0,o={},s={manual:r.Prism&&r.Prism.manual,disableWorkerMessageHandler:r.Prism&&r.Prism.disableWorkerMessageHan... L14: ?|

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-syntax-INF7-xC_.jsView on unpkg · L12

bin/orbitchat.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * ORBIT Chat CLI

4 *

5 * Serves the orbitchat as a standalone application with runtime configuration.

6 * Configuration is read from orbitchat.yaml.

7 * Secrets come from VITE_ADAPTER_KEYS / ORBIT_ADAPTER_KEYS env var.

8 */

10import express from 'express';

orbitchat.shView file

•path = orbitchat.sh kind = build_helper sizeBytes = 11860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

orbitchat.shView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

package.jsonView file

Lines 1-37json

2 "name": "orbitchat",

3 "private": false,

4 "version": "3.11.11",

5 "type": "module",

6 "bin"

dist/assets/cytoscape.esm-DTSO7Bv0.jsView file

•matchType = normalized_sha256 matchedPackage = @yancyyu/agentcli@1.9.25 matchedPath = dist-renderer/assets/cytoscape.esm-DsxaTqgk.js matchedIdentity = npm:QHlhbmN5eXUvYWdlbnRjbGk:1.9.25 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/cytoscape.esm-DTSO7Bv0.jsView on unpkg

Source & flagged code

10 flagged

dist/assets/vendor-auth-aD_bwYde.jsView file

Lines 1-6javascript

4 auth0-spa-js must run on a secure origin. See https://github.com/auth0/auth0-spa-js/blob/main/FAQ.md#why-do-i-get-auth0-spa-js-must-run-on-a-secure-origin for more information.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/assets/vendor-auth-aD_bwYde.jsView on unpkg · L1

Long lines were clipped for display.

dist/assets/docx-preview-DehBmhog.jsView file

Lines 1-31javascript

dist/assets/vendor-syntax-INF7-xC_.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/vendor-syntax-INF7-xC_.jsView on unpkg · L12

bin/orbitchat.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * ORBIT Chat CLI

4 *

5 * Serves the orbitchat as a standalone application with runtime configuration.

6 * Configuration is read from orbitchat.yaml.

7 * Secrets come from VITE_ADAPTER_KEYS / ORBIT_ADAPTER_KEYS env var.

8 */

10import express from 'express';

orbitchat.shView file

•path = orbitchat.sh kind = build_helper sizeBytes = 11860 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

orbitchat.shView on unpkg

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

package.jsonView file

Lines 1-37json

2 "name": "orbitchat",

3 "private": false,

4 "version": "3.11.11",

5 "type": "module",

6 "bin"

dist/assets/cytoscape.esm-DTSO7Bv0.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/assets/cytoscape.esm-DTSO7Bv0.jsView on unpkg

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code