rsshub@1.0.0-master.abb7a21: Suspicious npm security report | LPM Firewall

Loading npm security reports…

rsshub@1.0.0-master.abb7a21: Suspicious npm security report | LPM Firewall

Source & flagged code

12 flagged · loading source

dist-lib/prime-community-BQcRgHXy.mjsView file

26patternName = supabase_service_key severity = critical line = 26 matchedText = const TO...ZA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist-lib/prime-community-BQcRgHXy.mjsView on unpkg · L26

26patternName = supabase_service_key severity = critical line = 26 matchedText = const TO...ZA";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/prime-community-BQcRgHXy.mjs

dist-lib/prime-community-BQcRgHXy.mjsView on unpkg · L26

dist-lib/common-config-DS4NCmvY.mjsView file

11const timezone$1 = timezone; L12: if (regex.test(result)) result = eval(result); L13: return result;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist-lib/common-config-DS4NCmvY.mjsView on unpkg · L11

dist-lib/registry-dev-BpPDWdA6.mjsView file

37const relativeModulePath = filePath.slice(targetDirectoryPath.length); L38: modules[relativeModulePath] = await import(pathToFileURL(filePath).href); L39: }));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-lib/registry-dev-BpPDWdA6.mjsView on unpkg · L37

dist-lib/feed-CF6oTB1b.mjsView file

22}; L23: const rootUrl = "https://locals.com"; L24: const route = { ... L203: const response = await rofetch.raw(`${rootUrl}/_server`, { L204: body: createRequestBody(args), L205: headers: {

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist-lib/feed-CF6oTB1b.mjsView on unpkg · L22

dist-lib/explore-DBLFkajT.mjsView file

10const iv = CryptoJS.enc.Utf8.parse("Nmc09JkLzX8765Vb"); L11: const baseUrl = "https://pubscholar.cn"; L12: const sha1 = (str) => crypto.createHash("sha1").update(str).digest("hex"); ... L76: }, L77: body: { L78: page: 1,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist-lib/explore-DBLFkajT.mjsView on unpkg · L10

dist-lib/routes-Bsq8cnFH.mjsView file

•path = dist-lib/routes-Bsq8cnFH.mjs kind = oversized_source_file sizeBytes = 4099845 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/routes-Bsq8cnFH.mjsView on unpkg

dist-lib/utils-BiyO2GgI.mjsView file

3patternName = generic_password severity = medium line = 3 matchedText = const pw...75";

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-BiyO2GgI.mjs

dist-lib/utils-BiyO2GgI.mjsView on unpkg · L3

dist-lib/latest-5Ag0oZ4q.mjsView file

10patternName = private_key_rsa severity = critical line = 10 matchedText = const rs...--";

Critical

Secret Pattern

RSA private key in dist-lib/latest-5Ag0oZ4q.mjs

dist-lib/latest-5Ag0oZ4q.mjsView on unpkg · L10

dist-lib/utils-DQukqOO6.mjsView file

39patternName = generic_password severity = medium line = 39 matchedText = return m...ce);

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-DQukqOO6.mjs

dist-lib/utils-DQukqOO6.mjsView on unpkg · L39

dist-lib/pickup-DMF_SpxN.mjsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const re...K0";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/pickup-DMF_SpxN.mjs

dist-lib/pickup-DMF_SpxN.mjsView on unpkg · L13

dist-lib/charts-ZEGmB6FV.mjsView file

92patternName = google_api_key severity = high line = 92 matchedText = key: "AI..._dM"

High

Secret Pattern

Google API key in dist-lib/charts-ZEGmB6FV.mjs

dist-lib/charts-ZEGmB6FV.mjsView on unpkg · L92

Source & flagged code

12 flagged

dist-lib/prime-community-BQcRgHXy.mjsView file

Lines 6-46javascript

6 path: "/prime/community",

7 categories: ["new-media"],

8 example: "/sspai/prime/community",

9 features: {

10 requireConfig: [{

11 name: "SSPAI_BEARERTOKEN",

12 optional: false,

13 description: `少数派会员账号认证 token。获取方式：登陆后打开少数派会员社区界面，打开浏览器开发者工具中 “网络”(Network) 选项卡，筛选 URL 找到任一个地址为 \`sspai.com/api\` 开头的请求，点击检查其 “消息头”，在 “请求头” 中找到Authorization字段，将其值复制填入配置即可。你的配置应该形如 \`SSPAI_BEARERTOKEN: 'Bearer eyJxxxx......xx_U8'\`。`

14 }],

15 requirePuppeteer: false,

16 antiCrawler: false,

17 supportBT: false,

18 supportPodcast: false,

19 supportScihub: false

20 },

21 radar: [{ source: ["sspai.com/community"] }],

22 name: "会员社区",

23 maintainers: ["mintyfrankie"],

24 handler

25};

26const TOKEN = "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjcyNzU3NiIsInR5cGUiOiJ1c2VyIiwiZXhwIjoxNzQ4NTI2MDEzfQ.di8RB-lxHI_JMBQHFd2xhcpk6Zd_3bvfQlAti6HAuZA";

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist-lib/prime-community-BQcRgHXy.mjsView on unpkg · L26

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/prime-community-BQcRgHXy.mjs

dist-lib/prime-community-BQcRgHXy.mjsView on unpkg · L26

27async function handler() {

28 let token;

29 const cacheIn = await cache_default.get("sspai:token");

30 if (cacheIn) token = cacheIn;

31 else if (config.sspai.bearertoken) {

32 token = config.sspai.bearertoken;

33 cache_default.set("sspai:token", config.sspai.bearertoken);

34 } else token = TOKEN;

35 const feedEndpoint = "https://sspai.com/api/v1/community/page/get";

36 const headers = { Authorization: token };

37 const list = (await rofetch(feedEndpoint, { headers })).data.map((item) => ({

38 title: item.title,

39 link: `https://sspai.com/t/${item.id_hash}`,

40 pubDate: /* @__PURE__ */ new Date(item.created_at * 1e3),

41 author: item.author.nickname,

42 category: item.channel.title,

43 id_hash: item.id_hash

44 }));

45 return {

46 title: "少数派会员社区",

dist-lib/common-config-DS4NCmvY.mjsView file

Lines 1-31javascript

1import { t as rofetch } from "./ofetch-vE-Fs8EZ.mjs";

2import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

3import { t as timezone } from "./timezone-BBvDwS_3.mjs";

dist-lib/registry-dev-BpPDWdA6.mjsView file

Lines 17-57javascript

17 const files = [];

18 for (const entry of entries) {

19 const fullPath = path.join(targetDirectoryPath, entry.name);

dist-lib/feed-CF6oTB1b.mjsView file

Lines 2-42javascript

2import { t as config } from "./config-CPz0CKkC.mjs";

3import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

4import { t as cache_default } from "./cache-AVLkxzHf.mjs";

dist-lib/explore-DBLFkajT.mjsView file

Lines 1-30javascript

1import { t as rofetch } from "./ofetch-vE-Fs8EZ.mjs";

2import { t as parseDate } from "./parse-date-Cr0wQjV_.mjs";

3import { t as md5 } from "./md5-CpIHIxCO.mjs";

dist-lib/routes-Bsq8cnFH.mjsView file

•path = dist-lib/routes-Bsq8cnFH.mjs kind = oversized_source_file sizeBytes = 4099845 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist-lib/routes-Bsq8cnFH.mjsView on unpkg

dist-lib/utils-BiyO2GgI.mjsView file

Lines 1-23javascript

1//#region lib/routes/5eplay/utils.ts

2const getAcwScV2ByArg1 = (arg1) => {

3 const pwd = "3000176000856006061501533003690027800375";

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-BiyO2GgI.mjs

dist-lib/utils-BiyO2GgI.mjsView on unpkg · L3

dist-lib/latest-5Ag0oZ4q.mjsView file

Lines 1-30javascript

1import { t as rofetch } from "./ofetch-vE-Fs8EZ.mjs";

2import { t as config } from "./config-CPz0CKkC.mjs";

3import "./types-DNj6Etbg.mjs";

4import { t as cache_default }

dist-lib/utils-DQukqOO6.mjsView file

39patternName = generic_password severity = medium line = 39 matchedText = return m...ce);

Medium

Secret Pattern

Hardcoded password in dist-lib/utils-DQukqOO6.mjs

dist-lib/utils-DQukqOO6.mjsView on unpkg · L39

dist-lib/pickup-DMF_SpxN.mjsView file

13patternName = supabase_service_key severity = critical line = 13 matchedText = const re...K0";

Critical

Secret Pattern

Supabase service role key (JWT) in dist-lib/pickup-DMF_SpxN.mjs

dist-lib/pickup-DMF_SpxN.mjsView on unpkg · L13

dist-lib/charts-ZEGmB6FV.mjsView file

92patternName = google_api_key severity = high line = 92 matchedText = key: "AI..._dM"

High

Secret Pattern

Google API key in dist-lib/charts-ZEGmB6FV.mjs

dist-lib/charts-ZEGmB6FV.mjsView on unpkg · L92