sumanmovies: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

sumanmovies: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

3scripts.postinstall = node scripts/postinstall.js Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L3: const os = require('os'); L4: const https = require('https'); L5: const http = require('http'); L6: const { execSync } = require('child_process'); ... L52: return new Promise((resolve, reject) => { L53: const file = fs.createWriteStream(destPath); L54: const client = url.startsWith('https') ? https : http; L55: ... L63: if (fs.existsSync(destPath)) { L64: try { fs.unlinkSync(destPath); } catch (_) {} L65: } ... L71: if (fs.existsSync(destPath)) {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/sumanmovies.jsView file

2L3: const { spawn } = require('child_process'); L4: const path = require('path');

High

Child Process

Package source references child process execution.

bin/sumanmovies.jsView on unpkg · L2

•matchType = normalized_sha256 matchedPackage = sumanmovies@1.0.4 matchedPath = bin/sumanmovies.js matchedIdentity = npm:c3VtYW5tb3ZpZXM:1.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/sumanmovies.jsView on unpkg

lib/installer.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = sumanmovies@1.0.2 matchedIdentity = npm:c3VtYW5tb3ZpZXM:1.0.2 similarity = 0.625 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/installer.jsView on unpkg

194if (isWin) { L195: execSync(`powershell -NoProfile -Command "Expand-Archive -Path '${tempFile}' -DestinationPath '${storageDir}' -Force"`, { stdio: 'ignore' }); L196: for (const cand of ['sumanmovies-tui.exe', 'sumanmovies.exe']) {

High

Shell

Package source references shell execution.

lib/installer.jsView on unpkg · L194

626try { L627: execSync('npm install -g sumanmovies@latest', { stdio: 'inherit' }); L628: console.log(' ✓ Global npm package updated.');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/installer.jsView on unpkg · L626

dist/sumanmovies.exeView file

•path = dist/sumanmovies.exe kind = native_binary sizeBytes = 10450432 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/sumanmovies.exeView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 1-34json

1{

2 "name": "sumanmovies",

3 "version": "1.0.5",

4 "description": "SumanMovies - Terminal Movie & TV Streaming Experience",

5 "main": "bin/sumanmovies.js",

6 "bin": {

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L3

7 "sumanmovies": "bin/sumanmovies.js",

8 "SumanMovies": "bin/sumanmovies.js",

9 "sumanmovies-wezterm": "bin/wezterm.js",

10 "sumanmovies-update": "bin/update.js",

11 "sumanmovies-uninstall": "bin/uninstall.js"

12 },

13 "scripts": {

14 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 "preuninstall": "node scripts/uninstall.js",

16 "uninstall": "node scripts/uninstall.js",

17 "update": "node scripts/update.js",

18 "start": "node bin/sumanmovies.js"

19 },

20 "keywords": [

21 "sumanmovies",

22 "movies",

23 "tv",

24 "streaming",

25 "tui",

26 "terminal",

27 "cli",

28 "mpv"

29 ],

30 "author": "Suman",

31 "license": "MIT",

32 "engines": {

33 "node": ">=16.0.0"

34 },

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

package.jsonView on unpkg

bin/sumanmovies.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2

3const { spawn } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/sumanmovies.js

lib/installer.jsView file

Lines 174-214javascript

174 } else if (isAndroid) {

175 archiveName = `SumanMovies_Android_${arch}.tar.gz`;

176 } else {

177 archiveName = `SumanMovies_Linux_${arch}.tar.gz`;

178

dist/sumanmovies.exeView file

•path = dist/sumanmovies.exe kind = native_binary sizeBytes = 10450432 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/sumanmovies.exeView on unpkg