spoint@0.1.678: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

spoint@0.1.678: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/patch-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

server.jsView file

26import { fileURLToPath } from 'node:url' L27: import { execFileSync } from 'node:child_process' L28:

High

Child Process

Package source references child process execution.

server.jsView on unpkg · L26

src/sdk/scaffold.jsView file

27console.log(`[scaffold] created apps/ at ${localApps}`) L28: let result = spawnSync('bunx', ['skills', 'add', 'AnEntrypoint/spawnpoint', '--agent', '*', '--skill', 'spoint', '--yes'], { stdio: 'inherit', shell: true }) L29: if (result.status !== 0) {

High

Shell

Package source references shell execution.

src/sdk/scaffold.jsView on unpkg · L27

27console.log(`[scaffold] created apps/ at ${localApps}`) L28: let result = spawnSync('bunx', ['skills', 'add', 'AnEntrypoint/spawnpoint', '--agent', '*', '--skill', 'spoint', '--yes'], { stdio: 'inherit', shell: true }) L29: if (result.status !== 0) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/sdk/scaffold.jsView on unpkg · L27

src/sdk/SandboxEvaluator.jsView file

104'Object.prototype', 'globalThis', 'import(', L105: 'require(', 'eval(', 'Function(', L106: 'WebAssembly.', 'new Worker',

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/sdk/SandboxEvaluator.jsView on unpkg · L104

bin/router-boot.jsView file

39console.log(`[router-boot] using world: ${worldName}`) L40: const worldDef = (await import(pathToFileURL(worldPath).href + `?t=${Date.now()}`)).default || {} L41:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/router-boot.jsView on unpkg · L39

src/static/ProgressiveBake.jsView file

53const jsonLen = b.readUInt32LE(12) L54: const json = JSON.parse(b.slice(20, 20 + jsonLen).toString()) L55: const samplers = json.samplers || [] ... L93: const out = Buffer.alloc(total) L94: out.write('glTF', 0); out.writeUInt32LE(2, 4); out.writeUInt32LE(total, 8) L95: out.writeUInt32LE(jb.length, 12); out.writeUInt32LE(0x4E4F534A, 16); jb.copy(out, 20)

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/static/ProgressiveBake.jsView on unpkg · L53

bin/ktx.exeView file

•path = bin/ktx.exe kind = native_binary sizeBytes = 2034592 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ktx.exeView on unpkg

client/basis/basis_transcoder.wasmView file

•path = client/basis/basis_transcoder.wasm kind = wasm_module sizeBytes = 527333 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

client/basis/basis_transcoder.wasmView on unpkg

src/sdk/RoomOrchestrator.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = spoint@0.1.595 matchedIdentity = npm:c3BvaW50:0.1.595 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/sdk/RoomOrchestrator.jsView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 6-46json

6 "workspaces": [

7 "packages/*"

8 ],

9 "sideEffects": [

10 "src/protocol/MessageTypes.js"

11 ],

12 "bin": {

13 "spoint": "./server.js",

14 "spoint-create-app": "./bin/create-app.js",

15 "create-spoint-game": "./bin/create-project.js",

16 "spoint-static-export": "./scripts/static-export.mjs",

17 "spoint-router": "./bin/router-boot.js",

18 "spoint-room-orchestrator": "./bin/room-orchestrator-boot.js"

19 },

20 "scripts": {

21 "start": "node server.js",

22 "create-app": "node ./bin/create-app.js",

23 "create-project": "node ./bin/create-project.js",

24 "router-boot": "node ./bin/router-boot.js",

25 "room-orchestrator-boot": "node ./bin/room-orchestrator-boot.js",

26 "postinstall": "node scripts/patch-deps.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

27 "build:client": "node scripts/bundle-client.mjs",

28 "static-export": "node scripts/static-export.mjs",

29 "bundle-apps-manifest": "node scripts/bundle-apps-manifest.mjs",

30 "prep-edge-collider-assets": "node scripts/prep-edge-collider-assets.mjs",

31 "prep-edge-collider-assets:check": "node scripts/prep-edge-collider-assets.mjs --check",

32 "perf-gate": "node scripts/perf-gate.mjs",

33 "bundle-size-gate": "node scripts/bundle-size-gate.mjs",

34 "cold-load-gate": "node scripts/cold-load-gate.mjs",

35 "check": "node scripts/check.mjs",

36 "gen-typings": "node scripts/gen-sdk-typings.mjs",

37 "check:sdk-types": "node scripts/check-sdk-types.mjs",

38 "test": "node scripts/check.mjs",

39 "build:sph": "asc src/fluid/as-src/sph.ts --outFile src/fluid/sph.wasm --textFile src/fluid/sph.wat --optimize --runtime stub --exportRuntime",

40 "build:sph3d": "asc src/fluid/as-src/sph3d.ts --outFile src/fluid/sph3d.wasm --textFile src/fluid/sph3d.wat --optimize --runtime stub --exportRuntime"

41 },

42 "files": [

43 "src/",

44 "apps/",

45 "client/",

46 "!client/test-*.html",

server.jsView file

Lines 6-46javascript

6// -- so a totally-missing node_modules (a fresh `git worktree add`, never linked/installed) aborts at

7// `ERR_MODULE_NOT_FOUND: Cannot find package 'xstate'` from deep inside ReloadManager.js, and

8// src/sdk/server.js's own boot()-time assertNodeModulesLinked() guard (see that function's comment)

9// NEVER RUNS -- it's dead code for this exact case, since the throw happens during import resolution,

10// before boot() is even reachable. Live-reproduced in a genuinely node_modules-less worktree: `node

11// server.js` printed a raw unattributed ERR_MODULE_NOT_FOUND stack naming 'xstate' with zero mention

12// of node_modules or the actual fix, instead of assertNodeModulesLinked's clear FATAL message.

13// Fix: check node_modules HERE, with only node:fs/node:path/node:url (which resolve fine with zero

14// node_modules since they're builtins), before dynamically importing './src/sdk/server.js' -- a

src/sdk/scaffold.jsView file

Lines 7-35javascript

7

8function copyDir(src, dest) {

9 mkdirSync(dest, { recursive: true })

10 for (const entry of readdirSync(src, { withFileTypes: true

src/sdk/SandboxEvaluator.jsView file

Lines 84-124javascript

84 // replace with our sandboxed global.

85 const fn = this._compileInSandbox(wrappedSource, sandboxGlobal)

86 const appDef = fn()

87

88

bin/router-boot.jsView file

Lines 19-59javascript

19// precedence convention in src/sdk/server.js): PORT, SHARD_GRID_RADIUS, SHARD_CELL_SIZE, SHARD_GHOST_MARGIN.

20import { existsSync } from 'node:fs'

21import { resolve, join, dirname } from 'node:path'

22import { fileURLToPath, pathToFileURL } from 'node:url'

23import { RegionRouter } from '../src/sharding/RegionRouter.js'

src/static/ProgressiveBake.jsView file

Lines 33-73javascript

33 const dir = join(dirname(srcPath), CACHE_DIR_NAME)

34 if (!existsSync(dir)) mkdirSync(dir, { recursive: true })

35 return dir

bin/ktx.exeView file

•path = bin/ktx.exe kind = native_binary sizeBytes = 2034592 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/ktx.exeView on unpkg

client/basis/basis_transcoder.wasmView file

•path = client/basis/basis_transcoder.wasm kind = wasm_module sizeBytes = 527333 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

client/basis/basis_transcoder.wasmView on unpkg

src/sdk/RoomOrchestrator.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = spoint@0.1.595 matchedIdentity = npm:c3BvaW50:0.1.595 similarity = 0.817 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/sdk/RoomOrchestrator.jsView on unpkg