vaspera-pm: Suspicious npm security report (Warn)

Loading npm security reports…

vaspera-pm: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

dist/server.jsView file

79reason: `Trial limit reached (${TRIAL_CALL_LIMIT} calls). Subscribe for unlimited access OR use your own ANTHROPIC_API_KEY.`, L80: upgradeUrl: "https://vasperapm.com/pricing", L81: trialRemaining: 0 ... L180: // src/middleware/auth.ts L181: var VALIDATE_KEY_URL = process.env.VASPERA_API_URL || "https://vasperapm.com"; L182: var SUPABASE_URL = process.env.SUPABASE_URL || process.env.NEXT_PUBLIC_SUPABASE_URL || "http://127.0.0.1:54321"; ... L196: }, L197: body: JSON.stringify({ p_key_prefix: keyPrefix }) L198: }); ... L201: } L202: const results = await response.json(); L203: const result = results[0];

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server.jsView on unpkg · L79

490// src/middleware/repo.ts L491: import { execFileSync } from "child_process"; L492: function deriveRepoInfo(args) {

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L490

14889import * as path3 from "path"; L14890: var execAsync = promisify(exec); L14891: var GitHistoryAnalyzer = class {

High

Shell

Package source references shell execution.

dist/server.jsView on unpkg · L14889

3341script: | L3342: const issues = require('./issues.json').issues; L3343: for (const issue of issues) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L3341

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L79

dist/cli.jsView file

31Trigger-reachable chain: manifest.main -> dist/cli.js L31: reason: `Trial limit reached (${TRIAL_CALL_LIMIT} calls). Subscribe for unlimited access OR use your own ANTHROPIC_API_KEY.`, L32: upgradeUrl: "https://vasperapm.com/pricing", L33: trialRemaining: 0 ... L198: }, L199: body: JSON.stringify({ p_key_prefix: keyPrefix }) L200: }); ... L203: } L204: const results = await response.json(); L205: const result = results[0]; ... L245: async function validateApiKey(apiKey) { L246: if (process.env.VASPERA_DEV_MODE === "true") { L247: if (process.env.NODE_ENV === "production") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

506"use strict"; L507: USAGE_API_URL2 = process.env.VASPERA_API_URL || "https://vasperapm.com"; L508: INTERNAL_SERVICE_KEY2 = process.env.INTERNAL_SERVICE_KEY; ... L514: // src/middleware/repo.ts L515: import { execFileSync } from "child_process"; L516: function deriveRepoInfo(args) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L506

Source & flagged code

7 flagged · loading source

dist/server.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server.jsView on unpkg · L79

490// src/middleware/repo.ts L491: import { execFileSync } from "child_process"; L492: function deriveRepoInfo(args) {

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L490

14889import * as path3 from "path"; L14890: var execAsync = promisify(exec); L14891: var GitHistoryAnalyzer = class {

High

Shell

Package source references shell execution.

dist/server.jsView on unpkg · L14889

3341script: | L3342: const issues = require('./issues.json').issues; L3343: for (const issue of issues) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L3341

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L79

dist/cli.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L506

Source & flagged code

7 flagged

dist/server.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server.jsView on unpkg · L79

490// src/middleware/repo.ts L491: import { execFileSync } from "child_process"; L492: function deriveRepoInfo(args) {

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L490

14889import * as path3 from "path"; L14890: var execAsync = promisify(exec); L14891: var GitHistoryAnalyzer = class {

High

Shell

Package source references shell execution.

dist/server.jsView on unpkg · L14889

3341script: | L3342: const issues = require('./issues.json').issues; L3343: for (const issue of issues) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L3341

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L79

dist/cli.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L506

vaspera-pm@2.14.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code