sloth-d2c@1.0.6-beta.19: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

sloth-d2c@1.0.6-beta.19: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

15 flagged · loading source

dist/build/plugin/loader.jsView file

1import { execSync } from 'child_process'; L2: import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

cli/run.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sloth-d2c@1.0.6-beta.16 matchedIdentity = npm:c2xvdGgtZDJj:1.0.6-beta.16 similarity = 0.864 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/run.jsView on unpkg

143stdio: 'ignore', L144: shell: true, // 需要 shell 来解析命令 L145: windowsHide: true, // 隐藏windows下的命令行窗口

High

Shell

Package source references shell execution.

cli/run.jsView on unpkg · L143

361const installCmd = packageManager === 'pnpm' L362: ? `pnpm install -g ${packageName} --registry=https://registry.npmjs.org/` L363: : `npm install -g ${packageName} --registry=https://registry.npmjs.org/`; ... L365: try { L366: const result = spawnSync(installCmd, { L367: shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/run.jsView on unpkg · L361

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = cli/run.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

cli/run.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = dec59bb1b0c98a4c signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = cli/run.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 shingleOverlap = 27 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

cli/run.jsView on unpkg

dist/build/server.jsView file

810try { L811: selectionModule = await import(moduleUrl); L812: break;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build/server.jsView on unpkg · L810

dist/build/utils/tj.jsView file

1import * as os from 'os'; L2: import axios from 'axios'; L3: import { Logger } from './logger.js'; ... L6: */ L7: const isOnline = process.env.NODE_ENV === 'production'; L8: let lastEvent = ''; ... L37: osVersion: os.release(), L38: hostname: os.hostname(), L39: nodeVersion: process.version, ... L66: axios L67: .post('https://otheve.beacon.qq.com/analytics/v2_upload?appkey=0WEB0IK7H05E5K4S', { L68: appVersion: '',

High

Host Fingerprint Exfiltration

Source collects local host identity data and sends it to an external endpoint.

dist/build/utils/tj.jsView on unpkg · L1

package.jsonView file

•Runtime dependency names matching Node built-ins: crypto

High

Node Builtin Dependency Squat

Package declares a runtime dependency whose name matches a Node built-in module.

package.jsonView on unpkg

dist/build/agent/codex-bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/build/agent/codex-bridge.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/agent/codex-bridge.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/agent/codex-bridge.jsView on unpkg

dist/build/index.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/index.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/index.jsView on unpkg

dist/build/utils/utils.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/utils/utils.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/utils.jsView on unpkg

dist/build/interceptor/client.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/interceptor/client.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/interceptor/client.jsView on unpkg

dist/build/utils/version-check.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/utils/version-check.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/version-check.jsView on unpkg

Source & flagged code

15 flagged

dist/build/plugin/loader.jsView file

Lines 1-21javascript

1import { execSync } from 'child_process';

2import { promises as fs } from 'fs';

High

Child Process

Package source references child process execution.

dist/build/plugin/loader.jsView on unpkg · L1

3import * as path from 'path';

4import { fileURLToPath } from 'url';

5import envPaths from 'env-paths';

6import { PLUGIN_HOOKS } from './types.js';

7import { createRequire } from 'module';

8const __filename = fileURLToPath(import.meta.url);

9const __dirname = path.dirname(__filename);

10// 检测是否存在 pnpm

11function hasPnpm() {

12 try {

13 execSync('pnpm --version', { stdio: 'ignore' });

14 return true;

15 }

16 catch {

17 return false;

18 }

19}

20// 获取包管理器命令

21function getPackageManager() {

cli/run.jsView file

Lines 123-163javascript

123 const path = await import('node:path');

124

125 // // 获取当前脚本路径（兼容 Node.js 18）

126 const scriptPath = fileURLToPath(

dist/build/server.jsView file

Lines 790-830javascript

790 window.parent.postMessage(

791 {

792 type: 'sloth-d2c:implementation-toolbar-action',

793 payload: {

794 groupIndex,

795 buttonIndex,

796 },

797 },

798 '*',

dist/build/utils/tj.jsView file

Lines 1-21javascript

1import * as os from 'os';

2import axios from 'axios';

3import { Logger } from './logger.js';

4/*

5

package.jsonView file

Lines 74-110json

74 "react-hot-loader": "~4.13.0",

75 "react-inspector": "~6.0.2",

76 "reflect-metadata": "^0.2.0",

77 "rxjs": "^7.8.1",

78 "sloth-d2c-figma-plugin":

dist/build/agent/codex-bridge.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 15

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/build/agent/codex-bridge.jsView on unpkg

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/agent/codex-bridge.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/agent/codex-bridge.jsView on unpkg

dist/build/index.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/index.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/index.jsView on unpkg

dist/build/utils/utils.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/utils/utils.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/utils.jsView on unpkg

dist/build/interceptor/client.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/interceptor/client.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/interceptor/client.jsView on unpkg

dist/build/utils/version-check.jsView file

•matchType = normalized_sha256 matchedPackage = sloth-d2c-mcp@1.0.6-beta.19 matchedPath = dist/build/utils/version-check.js matchedIdentity = npm:c2xvdGgtZDJjLW1jcA:1.0.6-beta.19 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/build/utils/version-check.jsView on unpkg