vegas-chat@2.14.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

vegas-chat@2.14.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.preinstall = node -e "process.exit(process.version.slice(1).split('.')[0] < 18 ? 1 : 0)" || echo "vegas requires Node.js >= 18"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.preinstall = node -e "process.exit(process.version.slice(1).split('.')[0] < 18 ? 1 : 0)" || echo "vegas requires Node.js >= 18"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node -e "try{require('fs').chmodSync('dist/index.js',0o755)}catch(e){}"

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

153. You might have more than one copy of React in the same app L16: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function at(){ke.asyncTransitions--}function nt(z){if(Na===null)try{var Ie=("requ... L17: `+pe.replace(/^Error(:[^\n]*)?\n/,""))});return se.prototype=Object.create(K.prototype),se.prototype.constructor=se,se.prototype.toString=function(){return this.message===void 0?th... ... L23: `)a&&(o+=kN("")),o+=D9(u);else if(B===` L24: `){let N=[...u];R9(h.slice(w+1),N),o+=x9(N),a&&(o+=kN(a))}w+=B.length}return o}});import Vy from"node:process";import{execFileSync as L9}from"node:child_process";import SC from"nod... L25: at`)?" (<anonymous>)":-1<d.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.bin -> dist/index.js L15: 3. You might have more than one copy of React in the same app L16: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function at(){ke.asyncTransitions--}function nt(z){if(Na===null)try{var Ie=("requ... L17: `+pe.replace(/^Error(:[^\n]*)?\n/,""))});return se.prototype=Object.create(K.prototype),se.prototype.constructor=se,se.prototype.toString=function(){return this.message===void 0?th... ... L23: `)a&&(o+=kN("")),o+=D9(u);else if(B===` L24: `){let N=[...u];R9(h.slice(w+1),N),o+=x9(N),a&&(o+=kN(a))}w+=B.length}return o}});import Vy from"node:process";import{execFileSync as L9}from"node:child_process";import SC from"nod... L25: at`)?" (<anonymous>)":-1<d.stack.indexOf("@")?"@unknown:0

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15

•matchType = previous_version_dangerous_delta matchedPackage = vegas-chat@2.14.0 matchedIdentity = npm:dmVnYXMtY2hhdA:2.14.0 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Source & flagged code

9 flagged

package.jsonView file

Lines 19-60json

19 },

20 "license": "MIT",

21 "author": "web-kamikaze",

22 "repository": {

23 "type": "git",

24 "url": "git+https://github.com/web-kamikaze/vegas-chat.git"

25 },

26 "bin": {

27 "vegas": "dist/index.js"

28 },

29 "type": "module",

30 "scripts": {

31 "build": "npm run build:dashboard && npm run build:bundle",

32 "build:dashboard": "cd src/router/dashboard && npm install --silent && npx vite build --config ../../../vite.config.ts 2>&1 | tail -5",

33 "build:ts": "tsc",

34 "start": "node dist/index.js",

35 "dev": "tsx src/index.ts",

36 "router": "node -e \"require('./dist/router/use9router.js').start9Router(20128).then(() => console.log('9Router started on port 20128')).catch(e => console.error(e))\"",

37 "lint": "eslint src/ --max-warnings 100",

38 "prepublishOnly": "npm run build",

39 "preinstall": "node -e \"process.exit(process.version.slice(1).split('.')[0] < 18 ? 1 : 0)\" || echo \"vegas requires Node.js >= 18\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L39

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L39

40 "postinstall": "node -e \"try{require('fs').chmodSync('dist/index.js',0o755)}catch(e){}\"",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L40

41 "build:bundle": "node scripts/build-bundle.mjs"

42 },

43 "engines": {

44 "node": ">=18.0.0"

45 },

46 "files": [

47 "dist/index.js",

48 "dist/cyberpunk-theme.css",

49 "dist/pintar-instructions.md",

50 "dist/router/cyberpunk-theme.css",

51 "dist/dashboard",

52 "README.md",

53 "LICENSE"

54 ],

55 "devDependencies": {

56 "@types/diff": "^7.0.2",

57 "@types/google.maps": "^3.65.2",

58 "@types/node": "^20.0.0",

59 "@types/react": "^19.2.17",

60 "@typescript-eslint/eslint-plugin": "^8.62.1",

dist/index.jsView file

153. You might have more than one copy of React in the same app L16: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function at(){ke.asyncTransitions--}function nt(z){if(Na===null)try{var Ie=("requ... L17: `+pe.replace(/^Error(:[^\n]*)?\n/,""))});return se.prototype=Object.create(K.prototype),se.prototype.constructor=se,se.prototype.toString=function(){return this.message===void 0?th... ... L23: `)a&&(o+=kN("")),o+=D9(u);else if(B===` L24: `){let N=[...u];R9(h.slice(w+1),N),o+=x9(N),a&&(o+=kN(a))}w+=B.length}return o}});import Vy from"node:process";import{execFileSync as L9}from"node:child_process";import SC from"nod... L25: at`)?" (<anonymous>)":-1<d.stack.indexOf("@")?"@unknown:0:0":""}return`

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/index.jsView on unpkg · L15

15Trigger-reachable chain: manifest.bin -> dist/index.js L15: 3. You might have more than one copy of React in the same app L16: See https://react.dev/link/invalid-hook-call for tips about how to debug and fix this problem.`),z}function at(){ke.asyncTransitions--}function nt(z){if(Na===null)try{var Ie=("requ... L17: `+pe.replace(/^Error(:[^\n]*)?\n/,""))});return se.prototype=Object.create(K.prototype),se.prototype.constructor=se,se.prototype.toString=function(){return this.message===void 0?th... ... L23: `)a&&(o+=kN("")),o+=D9(u);else if(B===` L24: `){let N=[...u];R9(h.slice(w+1),N),o+=x9(N),a&&(o+=kN(a))}w+=B.length}return o}});import Vy from"node:process";import{execFileSync as L9}from"node:child_process";import SC from"nod... L25: at`)?" (<anonymous>)":-1<d.stack.indexOf("@")?"@unknown:0

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg · L15