wanar-ai@1.0.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

wanar-ai@1.0.1: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

16 flagged · loading source

src/tools/job-agent.jsView file

208patternName = google_api_key severity = high line = 208 matchedText = 'https:/...gw',

High

High Secret

Package contains a high-severity secret pattern.

src/tools/job-agent.jsView on unpkg · L208

208patternName = google_api_key severity = high line = 208 matchedText = 'https:/...gw',

High

Secret Pattern

Google API key in src/tools/job-agent.js

src/tools/job-agent.jsView on unpkg · L208

src/tools/shell.jsView file

1import { execSync, spawn } from 'child_process'; L2: import path from 'path';

High

Child Process

Package source references child process execution.

src/tools/shell.jsView on unpkg · L1

src/tools/security.jsView file

4L5: const execAsync = promisify(exec); L6:

High

Shell

Package source references shell execution.

src/tools/security.jsView on unpkg · L4

src/ai-manager.jsView file

81- JANGAN pernah bilang "saya tidak bisa mengakses" sebelum mencoba L82: - Jobstreet Indonesia: https://www.jobstreet.co.id/jobs L83: - Glints: https://glints.[redacted] ... L315: - **XSS**: Reflected, Stored, DOM-based L316: - **Insecure Deserialization**: eval(), unserialize dari user input L317: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE ... L381: - ....//....//etc/passwd (bypass filter) L382: - Wrapper exploitation (php://filter, data://) L383: L384: **Command Injection** L385: - ; cat /etc/passwd L386: - | whoami

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/ai-manager.jsView on unpkg · L81

315- **XSS**: Reflected, Stored, DOM-based L316: - **Insecure Deserialization**: eval(), unserialize dari user input L317: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/ai-manager.jsView on unpkg · L315

src/server.jsView file

1434app.post('/api/job-agent/launch-chrome', asyncHandler(async (req, res) => { L1435: const { execSync, spawn } = await import('child_process'); L1436: ... L1438: try { L1439: const cdpRes = await fetch('http://localhost:9222/json/version', { signal: AbortSignal.timeout(1500) }); L1440: if (cdpRes.ok) { ... L1448: 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe', L1449: `C:\\Users\\${process.env.USERNAME}\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe`, L1450: ];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.jsView on unpkg · L1434

src/security-scanner.jsView file

5L6: import axios from 'axios'; L7: import fs from 'fs'; ... L11: const __filename = fileURLToPath(import.meta.url); L12: const __dirname = path.dirname(__filename); L13: ... L297: const cleaned = result.content.replace(/```json\s*/g, '').replace(/```\s*/g, '').trim(); L298: const aiResponse = JSON.parse(cleaned); L299: console.log('[AI Analysis] JSON parsed successfully'); ... L1119: try { L1120: await axios.post(target, { L1121: username: username,

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/security-scanner.jsView on unpkg · L5

1157patternName = generic_password severity = medium line = 1157 matchedText = { userna...' },

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L1157

4065patternName = generic_password severity = medium line = 4065 matchedText = result.c... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4065

4094patternName = generic_password severity = medium line = 4094 matchedText = { cmd: '...) },

Source & flagged code

16 flagged

src/tools/job-agent.jsView file

Lines 188-228javascript

188 break;

189 }

190 }

191 if (!audioFrame) audioFrame = captchaFrame;

192

193 // Ambil URL audio MP3

194 const audioEl = audioFrame.locator('.rc-audiochallenge-tdownload-link, audio source, #audio-source');

195 if (await audioEl.count() === 0) return false;

196 const audioUrl = await audioEl.getAttribute('href') || await audioEl.getAttribute('src');

197 if (!audioUrl) return false;

198

199 // Download audio MP3

200 const audioRes = await fetch(audioUrl).catch(() => null);

201 if (!audioRes || !audioRes.ok) return false;

202 const audioBuffer = Buffer.from(await audioRes.arrayBuffer());

203

204 // Transcribe pakai Google Speech-to-Text (free endpoint yang sama dengan Chrome Speech API)

205 // Endpoint ini tidak butuh API key untuk penggunaan ringan

206 const base64Audio = audioBuffer.toString('base64');

207 const speechRes = await fetch(

208 'https://www.google.com/speech-api/v2/recognize?output=json&lang=en-US&key=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw',

High

High Secret

Package contains a high-severity secret pattern.

src/tools/job-agent.jsView on unpkg · L208

High

Secret Pattern

Google API key in src/tools/job-agent.js

src/tools/job-agent.jsView on unpkg · L208

209 {

210 method: 'POST',

211 headers: { 'Content-Type': 'audio/x-flac; rate=16000' },

212 body: audioBuffer,

213 }

214 ).catch(() => null);

215

216 let transcript = '';

217 if (speechRes && speechRes.ok) {

218 const text = await speechRes.text();

219 // Response format: {"result":[{"alternative":[{"transcript":"...","confidence":0.9}],"final":true}],"result_index":0}

220 const lines = text.split('\n').filter(Boolean);

221 for (const line of lines) {

222 try {

223 const json = JSON.parse(line);

224 transcript = json?.result?.[0]?.alternative?.[0]?.transcript || '';

225 if (transcript) break;

226 } catch {}

227 }

228 }

src/tools/shell.jsView file

Lines 1-21javascript

1import { execSync, spawn } from 'child_process';

2import path from 'path';

High

Child Process

Package source references child process execution.

src/tools/shell.jsView on unpkg · L1

3

4const DEFAULT_WORKDIR = process.cwd

src/tools/security.jsView file

Lines 1-24javascript

1import axios from 'axios';

2import { exec } from 'child_process';

3import { promisify } from 'util';

4

5const execAsync =

src/ai-manager.jsView file

Lines 61-101javascript

61- GUNAKAN indentasi spasi untuk sub-item, bukan markdown nested list

62- Untuk kode, cukup tulis kode langsung tanpa backtick fence jika konteksnya jelas

63- Tulis plain text yang bersih, to the point, dan mudah dibaca di terminal

64

65Contoh SALAH:

66**Kemampuan utama:**

67

src/server.jsView file

Lines 1414-1454javascript

1414

1415// POST /api/job-agent/sessions/:id/start — mulai crawl & apply

1416app.post('/api/job-agent/sessions/:id/start', asyncHandler(async (req, res) => {

1417 const id = Number

src/security-scanner.jsView file

Lines 1-25javascript

1/**

2 * Security Scanner Module - Realtime Security Testing

3 * by Wisnu Alfian Nur Ashar

4 */

5

6import axios from 'axios';

7import fs from 'fs';

8import path