raffaela-app@1.0.0: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

raffaela-app@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node raffaela.js --version

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node raffaela.js --version Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: L5: const { spawn } = require('child_process'); L6: const fs = require('fs'); ... L8: const path = require('path'); L9: const https = require('https'); L10: L11: const BIN_URL = 'https://raffaela.dev/bin'; L12: const VERSION = '1.1.8'; ... L27: L28: function getBinPath() { L29: const cacheDir = path.join(os.homedir(), '.raffaela', 'bin'); ... L35: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

11"scripts": { "postinstall": "node raffaela.js --version" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs the launcher during package installation.

package.jsonView on unpkg · L11

•scripts.postinstall = node raffaela.js --version

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

raffaela.jsView file

4L5: const { spawn } = require('child_process'); L6: const fs = require('fs'); ... L8: const path = require('path'); L9: const https = require('https'); L10: ... L28: function getBinPath() { L29: const cacheDir = path.join(os.homedir(), '.raffaela', 'bin'); L30: const binName = getPlatform(); ... L62: const url = `${BIN_URL}/${getPlatform()}`; L63: process.stderr.write(`⬇️ Baixando Raffaela ${VERSION}...\n`); L64: await download(url, binPath);

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

raffaela.jsView on unpkg · L4

1#!/usr/bin/env node // Raffaela CLI — thin launcher (downloads/executes compiled binary) // No source code exposed. Binary hosted on raffaela.dev.

High

Ai Review Evidence

The launcher states that it downloads and executes a compiled binary whose source is unavailable.

raffaela.jsView on unpkg · L1

28function getBinPath() { const cacheDir = path.join(os.homedir(), '.raffaela', 'bin'); const binName = getPlatform(); return path.join(cacheDir, binName); }

High

Ai Review Evidence

It writes the downloaded platform binary into the user's home-directory cache and marks it executable.

raffaela.jsView on unpkg · L28

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node raffaela.js --version

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

4scripts.postinstall = node raffaela.js --version Install-time code downloads an unverified remote native executable, stages it locally, activates an executable path, and exposes it to process execution. L4: L5: const { spawn } = require('child_process'); L6: const fs = require('fs'); ... L8: const path = require('path'); L9: const https = require('https'); L10: L11: const BIN_URL = 'https://raffaela.dev/bin'; L12: const VERSION = '1.1.8'; ... L27: L28: function getBinPath() { L29: const cacheDir = path.join(os.homedir(), '.raffaela', 'bin'); ... L35: return new Promise((resolve, reject) => {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L4

11"scripts": { "postinstall": "node raffaela.js --version" }

High

Suspicious Lifecycle Evidence

The postinstall hook automatically runs the launcher during package installation.

package.jsonView on unpkg · L11

•scripts.postinstall = node raffaela.js --version

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

raffaela.jsView file

4L5: const { spawn } = require('child_process'); L6: const fs = require('fs'); ... L8: const path = require('path'); L9: const https = require('https'); L10: ... L28: function getBinPath() { L29: const cacheDir = path.join(os.homedir(), '.raffaela', 'bin'); L30: const binName = getPlatform(); ... L62: const url = `${BIN_URL}/${getPlatform()}`; L63: process.stderr.write(`⬇️ Baixando Raffaela ${VERSION}...\n`); L64: await download(url, binPath);

High

Remote System File Write

Source writes bytes from a remote response into a privileged operating-system path.

raffaela.jsView on unpkg · L4

1#!/usr/bin/env node // Raffaela CLI — thin launcher (downloads/executes compiled binary) // No source code exposed. Binary hosted on raffaela.dev.

High

Ai Review Evidence

The launcher states that it downloads and executes a compiled binary whose source is unavailable.

raffaela.jsView on unpkg · L1

28function getBinPath() { const cacheDir = path.join(os.homedir(), '.raffaela', 'bin'); const binName = getPlatform(); return path.join(cacheDir, binName); }

High

Ai Review Evidence

It writes the downloaded platform binary into the user's home-directory cache and marks it executable.

raffaela.jsView on unpkg · L28