sloth-d2c-mcp: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sloth-d2c-mcp: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

dist/build/plugin/loader.jsView file

1import { execSync } from 'child_process'; L2: import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

81const globalDir = getGlobalPackageDir(); L82: const require = createRequire(path.join(globalDir)); L83: const resolvedPath = require.resolve(packageName);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build/plugin/loader.jsView on unpkg · L81

dist/build/utils/tj.jsView file

1import * as os from 'os'; L2: import axios from 'axios'; L3: import { Logger } from './logger.js'; ... L6: */ L7: const isOnline = process.env.NODE_ENV === 'production'; L8: let lastEvent = ''; ... L37: osVersion: os.release(), L38: hostname: os.hostname(), L39: nodeVersion: process.version, ... L66: axios L67: .post('https://otheve.beacon.qq.com/analytics/v2_upload?appkey=0WEB0IK7H05E5K4S', { L68: appVersion: '',

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/build/utils/tj.jsView on unpkg · L1

cli/run.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c-mcp@1.0.6-beta.16 matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.16 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/run.jsView on unpkg

361const installCmd = packageManager === 'pnpm' L362: ? `pnpm install -g ${packageName} --registry=https://registry.npmjs.org/` L363: : `npm install -g ${packageName} --registry=https://registry.npmjs.org/`; ... L365: try { L366: const result = spawnSync(installCmd, { L367: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/run.jsView on unpkg · L361

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/build/agent/codex-bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/build/agent/codex-bridge.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/agent/codex-bridge.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/agent/codex-bridge.jsView on unpkg

dist/build/utils/utils.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/utils/utils.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/utils.jsView on unpkg

dist/build/interceptor/client.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/interceptor/client.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/interceptor/client.jsView on unpkg

dist/build/utils/version-check.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/utils/version-check.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/version-check.jsView on unpkg

Source & flagged code

11 flagged

dist/build/plugin/loader.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

3import * as path from 'path';

4import { fileURLToPath } from 'url';

5import envPaths from 'env-paths';

6import { PLUGIN_HOOKS } from './types.js';

7import { createRequire } from 'module';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10// 检测是否存在 pnpm

11function hasPnpm() {

12 try {

13 execSync('pnpm --version', { stdio: 'ignore' });

14 return true;

15 }

16 catch {

17 return false;

18 }

19}

20// 获取包管理器命令

21function getPackageManager() {

Lines 61-101javascript

61}

62// 保存全局插件配置

63async function saveGlobalPluginsConfig(config) {

64 const configPath = getGlobalPluginsConfigPath();

65 // 确保目录存在

66 await fs.mkdir

dist/build/utils/tj.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import axios from 'axios';

3import { Logger } from './logger.js';

4/*

5

cli/run.jsView file

Lines 341-381javascript

341 }

342 } catch {

343 // 检测失败，使用默认的 npm

344 }

345

346 console.log(`[sloth] 检测到包管理器: ${packageManager}`);

347 let packageName =

package.jsonView file

Lines 74-110json

74 "react-hot-loader": "~4.13.0",

75 "react-inspector": "~6.0.2",

76 "reflect-metadata": "^0.2.0",

77 "rxjs": "^7.8.1",

78 "sloth-d2c-figma-plugin":

dist/build/agent/codex-bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/build/agent/codex-bridge.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/agent/codex-bridge.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/agent/codex-bridge.jsView on unpkg

dist/build/utils/utils.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/utils/utils.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/utils.jsView on unpkg

dist/build/interceptor/client.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/interceptor/client.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/interceptor/client.jsView on unpkg

dist/build/utils/version-check.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.18 matchedPath = dist/build/utils/version-check.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.18 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/version-check.jsView on unpkg