secretloop@0.3.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

secretloop@0.3.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

out/mcp.jsView file

120`)||(u["#text"]="#text"in u?u["#text"]+l:l);for(let l of s)l.tag==="__proto__"&&_R(u),l.tag in u?Array.isArray(u[l.tag])?u[l.tag].push(l.value):u[l.tag]=[u[l.tag],l.value]:u[l.tag]... L121: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:t});return e},Lke=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.de... L122: Multiple credential sources detected:

High

Child Process

Package source references child process execution.

out/mcp.jsView on unpkg · L120

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function kme(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function wbe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

out/mcp.jsView on unpkg · L57

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function kme(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function wbe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

out/mcp.jsView on unpkg · L57

1#!/usr/bin/env node L2: "use strict";var vX=Object.create;var qh=Object.defineProperty;var bX=Object.getOwnPropertyDescriptor;var SX=Object.getOwnPropertyNames;var wX=Object.getPrototypeOf,$X=Object.proto... L3: `)}});var F0=I(G=>{"use strict";var pee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};ng.Doc=G0});var W0=I(og=>{"use strict";Object.defineProperty(og,"__esModule",{value:!0});og.version=void 0;og.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/mcp.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var vX=Object.create;var qh=Object.defineProperty;var bX=Object.getOwnPropertyDescriptor;var SX=Object.getOwnPropertyNames;var wX=Object.getPrototypeOf,$X=Object.proto... L3: `)}});var F0=I(G=>{"use strict";var pee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};ng.Doc=G0});var W0=I(og=>{"use strict";Object.defineProperty(og,"__esModule",{value:!0});og.version=void 0;og.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

out/mcp.jsView on unpkg · L1

66|| (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function wbe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i},

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/mcp.jsView on unpkg · L66

out/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = secretloop@0.2.0 matchedIdentity = npm:c2VjcmV0bG9vcA:0.2.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

out/cli.jsView on unpkg

1Trigger-reachable command-output exfiltration chain: manifest.bin -> out/cli.js L1: #!/usr/bin/env node L2: "use strict";var L1=Object.create;var qc=Object.defineProperty;var U1=Object.getOwnPropertyDescriptor;var B1=Object.getOwnPropertyNames;var z1=Object.getPrototypeOf,H1=Object.proto... L3: `).filter(a=>a.trim().length>0):kx(t,t),o=[],s=0,i=0;for(let a of n)switch(fo(a,e)){case"none":Pi(t,a)?o.push(a):i++;break;case"generated":s++;break;default:break}return{files:o,ge... L4: `).filter(r=>r.trim().length>0)}}function Px(t,e,r){let n=r.trim();return n?`git could not list staged files: ${n}`:e?`git was killed by ${e} before it could list staged files.`:`g... L5: `,e-1)+1;if(e<=r)return null;let n=t.slice(r,e),o=/["'`]?([A-Za-z_$][A-Za-z0-9_$]*)["'`]?\s*(?::=|[:=])\s*$/.exec(n);return o?o[

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

out/cli.jsView on unpkg · L1

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

Source & flagged code

9 flagged

out/mcp.jsView file

120`)||(u["#text"]="#text"in u?u["#text"]+l:l);for(let l of s)l.tag==="__proto__"&&_R(u),l.tag in u?Array.isArray(u[l.tag])?u[l.tag].push(l.value):u[l.tag]=[u[l.tag],l.value]:u[l.tag]... L121: Reference: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html`,{tryNextLink:!1,logger:t});return e},Lke=(e={})=>async({callerClientConfig:t}={})=>{e.logger?.de... L122: Multiple credential sources detected:

High

Child Process

Package source references child process execution.

out/mcp.jsView on unpkg · L120

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function kme(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function wbe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

out/mcp.jsView on unpkg · L57

57L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(s);continue}if(e.external){let u=e.exter... L59: `);if("message"in e&&typeof e.message=="string")return e.message;try{return JSON.stringify(e)}catch{return String(e)}}return String(e)}function kme(e){return e.description}function... ... L66: || (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function wbe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i}, ... L7

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

out/mcp.jsView on unpkg · L57

1#!/usr/bin/env node L2: "use strict";var vX=Object.create;var qh=Object.defineProperty;var bX=Object.getOwnPropertyDescriptor;var SX=Object.getOwnPropertyNames;var wX=Object.getPrototypeOf,$X=Object.proto... L3: `)}});var F0=I(G=>{"use strict";var pee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};ng.Doc=G0});var W0=I(og=>{"use strict";Object.defineProperty(og,"__esModule",{value:!0});og.version=void 0;og.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

out/mcp.jsView on unpkg · L1

1#!/usr/bin/env node L2: "use strict";var vX=Object.create;var qh=Object.defineProperty;var bX=Object.getOwnPropertyDescriptor;var SX=Object.getOwnPropertyNames;var wX=Object.getPrototypeOf,$X=Object.proto... L3: `)}});var F0=I(G=>{"use strict";var pee=G&&G.__createBinding||(Object.create?(function(e,t,r,i){i===void 0&&(i=r);var n=Object.getOwnPropertyDescriptor(t,r);(!n||("get"in n?!t.__es... ... L6: `)} L7: };`)(...Object.values(this.closed))}};ng.Doc=G0});var W0=I(og=>{"use strict";Object.defineProperty(og,"__esModule",{value:!0});og.version=void 0;og.version={major:4,minor:5,patch:1... L8: for (let i = 0; i < ${M}.issues.length; i++) { ... L58: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let s of e.seen.entries()){let a=s[1];if(t===s[0]){o(

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

out/mcp.jsView on unpkg · L1

66|| (${s} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,Te._)`+${n}`);return;case"boolean":i.elseIf((0,Te._)`${n} === "false" || ${n} === 0 || ${n} === null`).... L67: || ${s} === "boolean" || ${n} === null`).assign(a,(0,Te._)`[${n}]`)}}}function wbe({gen:e,parentData:t,parentDataProperty:r},i){e.if((0,Te._)`${t} !== undefined`,()=>e.assign((0,Te... L68: missingProperty: ${i},

Low

Eval

Package source references a known benign dynamic code generation pattern.

out/mcp.jsView on unpkg · L66

out/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var L1=Object.create;var qc=Object.defineProperty;var U1=Object.getOwnPropertyDescriptor;var B1=Object.getOwnPropertyNames;var z1=Object.getPrototypeOf,H1

package.jsonView file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg