shopport@0.5.8: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

shopport@0.5.8: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "try{require('child_process').execFileSync(process.execPath,['dist/cli.js','setup-skills'],{stdio:'pipe'})}catch(_){}"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('child_process').execFileSync(process.execPath,['dist/cli.js','setup-skills'],{stdio:'pipe'})}catch(_){}"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = shopport@0.5.0 matchedIdentity = npm:c2hvcHBvcnQ:0.5.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

1#!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/cli.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: scripts.start -> dist/cli.js L1: #!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/cli.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/cli.jsView on unpkg

Source & flagged code

8 flagged

package.jsonView file

Lines 1-36json

1{

2 "name": "shopport",

3 "version": "0.5.8",

4 "description": "커머스 운영 자동화 CLI — Cafe24, Coupang, SmartStore, Shopify 통합 관리",

5 "type": "module",

6 "bin": {

7 "sppt": "dist/cli.js",

8 "shopport": "dist/cli.js"

9 },

10 "scripts": {

11 "dev": "tsx watch src/cli.ts",

12 "build:dashboard": "cd dashboard-ui && bun install && bun run build",

13 "build": "bun run build:dashboard && tsup && node -e \"const fs=require('fs');const f='dist/cli.js';const c=fs.readFileSync(f,'utf8');fs.writeFileSync(f,'#!/usr/bin/env bun\\n'+c);fs.chmodSync(f,0o755)\"",

14 "start": "node dist/cli.js",

15 "build:publish": "SHOPPORT_PUBLISH=1 bun run build",

16 "postinstall": "node -e \"try{require('child_process').execFileSync(process.execPath,['dist/cli.js','setup-skills'],{stdio:'pipe'})}catch(_){}\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L16

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L16

17 "prepublishOnly": "bun run build:publish",

18 "test": "vitest run"

19 },

20 "keywords": [

21 "dropshipping",

22 "ecommerce",

23 "cafe24",

24 "coupang",

25 "smartstore",

26 "shopify",

27 "커머스운영",

28 "자동화"

29 ],

30 "license": "UNLICENSED",

31 "engines": {

32 "node": ">=18"

33 },

34 "files": ["dist", "README.md"],

35 "dependencies": {

36 "@browserbasehq/stagehand": "^2.0.0",

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = shopport@0.5.0 matchedIdentity = npm:c2hvcHBvcnQ:0.5.0 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

1#!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env bun L2: const _0xba7064=_0x5690;(function(_0x4d9037,_0x1b967a){const _0x119d6c=_0x5690,_0x48a86f=_0x4d9037();while(!![]){try{const _0x4ab121=parseInt(_0x119d6c(0x228e))/0x1*(-parseInt(_0x1...