vaspera-pm@2.14.1: Suspicious npm security report (Warn)

Loading npm security reports…

vaspera-pm@2.14.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged

dist/server.jsView file

79reason: `Trial limit reached (${TRIAL_CALL_LIMIT} calls). Subscribe for unlimited access OR use your own ANTHROPIC_API_KEY.`, L80: upgradeUrl: "https://vasperapm.com/pricing", L81: trialRemaining: 0 ... L180: // src/middleware/auth.ts L181: var VALIDATE_KEY_URL = process.env.VASPERA_API_URL || "https://vasperapm.com"; L182: var SUPABASE_URL = process.env.SUPABASE_URL || process.env.NEXT_PUBLIC_SUPABASE_URL || "http://127.0.0.1:54321"; ... L196: }, L197: body: JSON.stringify({ p_key_prefix: keyPrefix }) L198: }); ... L201: } L202: const results = await response.json(); L203: const result = results[0];

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server.jsView on unpkg · L79

445// src/middleware/repo.ts L446: import { execFileSync } from "child_process"; L447: function deriveRepoInfo(args) {

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L445

14816import * as path3 from "path"; L14817: var execAsync = promisify(exec); L14818: var GitHistoryAnalyzer = class {

High

Shell

Package source references shell execution.

dist/server.jsView on unpkg · L14816

3294script: | L3295: const issues = require('./issues.json').issues; L3296: for (const issue of issues) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L3294

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L79

dist/cli.jsView file

31Trigger-reachable chain: manifest.main -> dist/cli.js L31: reason: `Trial limit reached (${TRIAL_CALL_LIMIT} calls). Subscribe for unlimited access OR use your own ANTHROPIC_API_KEY.`, L32: upgradeUrl: "https://vasperapm.com/pricing", L33: trialRemaining: 0 ... L198: }, L199: body: JSON.stringify({ p_key_prefix: keyPrefix }) L200: }); ... L203: } L204: const results = await response.json(); L205: const result = results[0]; ... L245: async function validateApiKey(apiKey) { L246: if (process.env.VASPERA_DEV_MODE === "true") { L247: if (process.env.NODE_ENV === "production") {

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

453"use strict"; L454: USAGE_API_URL = process.env.VASPERA_API_URL || "https://vasperapm.com"; L455: INTERNAL_SERVICE_KEY = process.env.INTERNAL_SERVICE_KEY; ... L463: // src/middleware/repo.ts L464: import { execFileSync } from "child_process"; L465: function deriveRepoInfo(args) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L453

Source & flagged code

7 flagged · loading source

dist/server.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server.jsView on unpkg · L79

445// src/middleware/repo.ts L446: import { execFileSync } from "child_process"; L447: function deriveRepoInfo(args) {

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L445

14816import * as path3 from "path"; L14817: var execAsync = promisify(exec); L14818: var GitHistoryAnalyzer = class {

High

Shell

Package source references shell execution.

dist/server.jsView on unpkg · L14816

3294script: | L3295: const issues = require('./issues.json').issues; L3296: for (const issue of issues) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L3294

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L79

dist/cli.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L453

Source & flagged code

7 flagged

dist/server.jsView file

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server.jsView on unpkg · L79

445// src/middleware/repo.ts L446: import { execFileSync } from "child_process"; L447: function deriveRepoInfo(args) {

High

Child Process

Package source references child process execution.

dist/server.jsView on unpkg · L445

14816import * as path3 from "path"; L14817: var execAsync = promisify(exec); L14818: var GitHistoryAnalyzer = class {

High

Shell

Package source references shell execution.

dist/server.jsView on unpkg · L14816

3294script: | L3295: const issues = require('./issues.json').issues; L3296: for (const issue of issues) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server.jsView on unpkg · L3294

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/server.jsView on unpkg · L79

dist/cli.jsView file

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/cli.jsView on unpkg · L31

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L453

vaspera-pm@2.14.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code