sloth-d2c-figma-plugin@2.0.4-beta.22: Suspicious npm security | LPM Firewall

Loading npm security reports…

sloth-d2c-figma-plugin@2.0.4-beta.22: Suspicious npm security | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/core.esm.jsView file

1/*! For license information please see core.esm.js.LICENSE.txt */ L2: var e={9555:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.applyMatrixToPoint=function(e,t){return[t[0]*e[0][0]+t[1]*e[0][1]+e[0][2],t[0]*e[1][0]+t[1]*e[1][1]+e[1][2]]}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core.esm.jsView on unpkg · L1

dist/core.cjs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-figma-plugin@2.0.4-beta.20 matchedIdentity = npm:c2xvdGgtZDJjLWZpZ21hLXBsdWdpbg:2.0.4-beta.20 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core.cjs.jsView on unpkg

1(function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core.cjs.jsView on unpkg · L1

1(function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core.cjs.jsView on unpkg · L1

1(function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core.cjs.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/core.cjs.js L1: (function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/core.cjs.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core.cjs.jsView on unpkg

•path = dist/core.cjs.js kind = oversized_source_file sizeBytes = 7825175 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjs.jsView on unpkg

Source & flagged code

8 flagged

dist/core.esm.jsView file

1/*! For license information please see core.esm.js.LICENSE.txt */ L2: var e={9555:(e,t)=>{Object.defineProperty(t,"__esModule",{value:!0}),t.applyMatrixToPoint=function(e,t){return[t[0]*e[0][0]+t[1]*e[0][1]+e[0][2],t[0]*e[1][0]+t[1]*e[1][1]+e[1][2]]}...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/core.esm.jsView on unpkg · L1

dist/core.cjs.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-figma-plugin@2.0.4-beta.20 matchedIdentity = npm:c2xvdGgtZDJjLWZpZ21hLXBsdWdpbg:2.0.4-beta.20 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core.cjs.jsView on unpkg

1(function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/core.cjs.jsView on unpkg · L1

1(function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/core.cjs.jsView on unpkg · L1

1(function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/core.cjs.jsView on unpkg · L1

1Trigger-reachable command-output exfiltration chain: manifest.main -> dist/core.cjs.js L1: (function(_0x23a41a,_0xb2e464){const _0x592f04=a0_0x180d,_0x5b5f66=_0x23a41a();while(!![]){try{const _0x274c41=parseInt(_0x592f04(0x356a))/0x1*(-parseInt(_0x592f04(0x54f))/0x2)+-pa...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/core.cjs.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/core.cjs.jsView on unpkg

•path = dist/core.cjs.js kind = oversized_source_file sizeBytes = 7825175 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/core.cjs.jsView on unpkg