sloth-d2c-figma-plugin@2.0.4-beta.15: Suspicious npm security | LPM Firewall

Loading npm security reports…

sloth-d2c-figma-plugin@2.0.4-beta.15: Suspicious npm security | LPM Firewall

Source & flagged code

7 flagged · loading source

dist/core.cjs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-figma-plugin@2.0.4-beta.13 matchedIdentity = npm:c2xvdGgtZDJjLWZpZ21hLXBsdWdpbg:2.0.4-beta.13 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core.cjs.jsView on unpkg

1function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core.cjs.jsView on unpkg · L1

1function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core.cjs.jsView on unpkg · L1

1function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core.cjs.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/core.cjs.js L1: function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/core.cjs.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core.cjs.jsView on unpkg

•path = dist/core.cjs.js kind = oversized_source_file sizeBytes = 7752453 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjs.jsView on unpkg

Source & flagged code

7 flagged

dist/core.cjs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-figma-plugin@2.0.4-beta.13 matchedIdentity = npm:c2xvdGgtZDJjLWZpZ21hLXBsdWdpbg:2.0.4-beta.13 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core.cjs.jsView on unpkg

1function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core.cjs.jsView on unpkg · L1

1function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core.cjs.jsView on unpkg · L1

1function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core.cjs.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/core.cjs.js L1: function a0_0x432c(){const _0x4aab70=['lastRenderedReducer','FIGURE','\x27delete\x27\x20called\x20on\x20an\x20object\x20that\x20is\x20not\x20a\x20valid\x20instance\x20of\x20Headers...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/core.cjs.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core.cjs.jsView on unpkg

•path = dist/core.cjs.js kind = oversized_source_file sizeBytes = 7752453 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjs.jsView on unpkg