wanar-ai@1.0.6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

wanar-ai@1.0.6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

17 flagged · loading source

src/security-scanner.jsView file

5L6: import axios from 'axios'; L7: import fs from 'fs'; ... L11: const __filename = fileURLToPath(import.meta.url); L12: const __dirname = path.dirname(__filename); L13: ... L297: const cleaned = result.content.replace(/```json\s*/g, '').replace(/```\s*/g, '').trim(); L298: const aiResponse = JSON.parse(cleaned); L299: console.log('[AI Analysis] JSON parsed successfully'); ... L1125: try { L1126: await axios.post(target, { L1127: username: username,

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/security-scanner.jsView on unpkg · L5

1163patternName = generic_password severity = medium line = 1163 matchedText = { userna...' },

Medium

Secret Pattern

Package contains a possible secret pattern.

src/security-scanner.jsView on unpkg · L1163

4091patternName = generic_password severity = medium line = 4091 matchedText = result.c... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4091

4120patternName = generic_password severity = medium line = 4120 matchedText = { cmd: '...) },

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4120

4223patternName = generic_password severity = medium line = 4223 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4223

4265patternName = generic_password severity = medium line = 4265 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4265

4311patternName = generic_password severity = medium line = 4311 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4311

4391patternName = generic_password severity = medium line = 4391 matchedText = if (emai... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4391

5368patternName = generic_password severity = medium line = 5368 matchedText = credenti... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L5368

client/dist/assets/index-Yf8uu-wW.jsView file

108`+(s.tokens?this.parseInline(s.tokens):s.text);r+=n?this.renderer.paragraph(l):l;continue}default:{const s='Token with "'+i.type+'" type was not found.';if(this.options.silent)retu... L109: Please report this to https://github.com/markedjs/marked.`,e){const a="<p>An error occurred:</p><pre>"+Tt(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promis... L110: https://github.com/highlightjs/highlight.js/issues/2277`),F=D,w=U),P===void 0&&(P=!0);const q={code:w,language:F};se("before:highlight",q);const k=q.result?q.result:_(q.language,q....

High

Child Process

Package source references child process execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L108

112`},E]}}return _c=a,_c}var pc,HE;function DI(){if(HE)return pc;HE=1;function t(e){const n="[a-zA-Z_][\\w.]*",r="<\\?(lasso(script)?|=)",a="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L113: ]`,h={scope:"string",variants:[_,u,p,f]},S={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L114: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return xd=t,xd}var Nd,aS;function VA(){if(aS)return Nd;aS=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",r={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L112

src/ai-manager.jsView file

81- JANGAN pernah bilang "saya tidak bisa mengakses" sebelum mencoba L82: - Jobstreet Indonesia: https://www.jobstreet.co.id/jobs L83: - Glints: https://glints.[redacted] ... L321: - **XSS**: Reflected, Stored, DOM-based L322: - **Insecure Deserialization**: eval(), unserialize dari user input L323: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE ... L387: - ....//....//etc/passwd (bypass filter) L388: - Wrapper exploitation (php://filter, data://) L389: L390: **Command Injection** L391: - ; cat /etc/passwd L392: - | whoami

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/ai-manager.jsView on unpkg · L81

321- **XSS**: Reflected, Stored, DOM-based L322: - **Insecure Deserialization**: eval(), unserialize dari user input L323: - **Using Components with Known Vulnerabilities**: Outdated dependencies dengan CVE

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/ai-manager.jsView on unpkg · L321

src/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = wanar-ai@1.0.5 matchedIdentity = npm:d2FuYXItYWk:1.0.5 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/server.jsView on unpkg

1497app.post('/api/job-agent/launch-chrome', asyncHandler(async (req, res) => { L1498: const { execSync, spawn } = await import('child_process'); L1499: ... L1501: try { L1502: const cdpRes = await fetch('http://localhost:9222/json/version', { signal: AbortSignal.timeout(1500) }); L1503: if (cdpRes.ok) { ... L1511: 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe', L1512: `C:\\Users\\${process.env.USERNAME}\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe`, L1513: ];

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/server.jsView on unpkg · L1497

src/tools/job-agent.jsView file

121const origin = new URL(url).origin; L122: const res = await fetch(`${origin}/robots.txt`).catch(() => null); L123: if (!res || !res.ok) return true; L124: const text = await res.text(); L125: if (/disallow.*\/apply|disallow.*\/jobs.*apply/i.test(text)) return false; ... L206: const base64Audio = audioBuffer.toString('base64'); L207: const googleSpeechKey = process.env.GOOGLE_SPEECH_API_KEY; L208: if (!googleSpeechKey) { ... L216: headers: { 'Content-Type': 'audio/x-flac; rate=16000' }, L217: body: audioBuffer, L218: } ... L318: // PENTING: Google Forms memiliki elemen Google Account di header —

High

Credential Exfiltration

Source combines credential-like environment material and outbound requests; review data flow before blocking.

src/tools/job-agent.jsView on unpkg · L121

121Trigger-reachable credential exfiltration chain: scripts.dev -> src/server.js -> src/tools/job-agent.js L121: const origin = new URL(url).origin; L122: const res = await fetch(`${origin}/robots.txt`).catch(() => null); L123: if (!res || !res.ok) return true; L124: const text = await res.text(); L125: if (/disallow.*\/apply|disallow.*\/jobs.*apply/i.test(text)) return false; ... L206: const base64Audio = audioBuffer.toString('base64'); L207: const googleSpeechKey = process.env.GOOGLE_SPEECH_API_KEY; L208: if (!googleSpeechKey) { ... L216: headers: { 'Content-Type': 'audio/x-flac; rate=16000' }, L217: body: audioBuffer, L218: } ... L318: // PENTING: Google Forms memiliki elemen Google Account di header —

High

Trigger Reachable Credential Exfiltration

A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.

src/tools/job-agent.jsView on unpkg · L121

Source & flagged code

17 flagged

src/security-scanner.jsView file

Lines 1-25javascript

1/**

2 * Security Scanner Module - Realtime Security Testing

3 * by Wisnu Alfian Nur Ashar

4 */

5

6import axios from 'axios';

7import fs from 'fs';

8import path from 'path';

9import { fileURLToPath } from 'url';

10

11const __filename = fileURLToPath(import.meta.url);

12const __dirname = path.dirname(__filename);

13

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

src/security-scanner.jsView on unpkg · L5

14/**

15 * Security Vulnerability Scanner

16 * Scans web applications for common vulnerabilities

17 */

18export async function scanVulnerabilities(target, scanType = 'quick', modules = []) {

19 const results = {

20 timestamp: new Date().toISOString(),

21 target,

22 scanType,

23 vulnerabilities: [],

24 summary: {

25 total: 0,

Lines 1143-1183javascript

1143 }

1144

1145 } catch (error) {

1146 test.result = 'error';

1147 test.details.push(`Test error: ${error.message}`);

1148 }

1149

1150 return test;

4091patternName = generic_password severity = medium line = 4091 matchedText = result.c... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4091

4120patternName = generic_password severity = medium line = 4120 matchedText = { cmd: '...) },

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4120

4223patternName = generic_password severity = medium line = 4223 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4223

4265patternName = generic_password severity = medium line = 4265 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4265

4311patternName = generic_password severity = medium line = 4311 matchedText = if (user...}));

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4311

4391patternName = generic_password severity = medium line = 4391 matchedText = if (emai... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L4391

5368patternName = generic_password severity = medium line = 5368 matchedText = credenti... });

Medium

Secret Pattern

Hardcoded password in src/security-scanner.js

src/security-scanner.jsView on unpkg · L5368

client/dist/assets/index-Yf8uu-wW.jsView file

108`+(s.tokens?this.parseInline(s.tokens):s.text);r+=n?this.renderer.paragraph(l):l;continue}default:{const s='Token with "'+i.type+'" type was not found.';if(this.options.silent)retu... L109: Please report this to https://github.com/markedjs/marked.`,e){const a="<p>An error occurred:</p><pre>"+Tt(r.message+"",!0)+"</pre>";return n?Promise.resolve(a):a}if(n)return Promis... L110: https://github.com/highlightjs/highlight.js/issues/2277`),F=D,w=U),P===void 0&&(P=!0);const q={code:w,language:F};se("before:highlight",q);const k=q.result?q.result:_(q.language,q....

High

Child Process

Package source references child process execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L108

112`},E]}}return _c=a,_c}var pc,HE;function DI(){if(HE)return pc;HE=1;function t(e){const n="[a-zA-Z_][\\w.]*",r="<\\?(lasso(script)?|=)",a="\\]|\\?>",i={$pattern:n+"|&[lg]t;",literal... L113: ]`,h={scope:"string",variants:[_,u,p,f]},S={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[... L114: ]*;`,relevance:0},{begin:"[vp][0-9]+"}]}}return xd=t,xd}var Nd,aS;function VA(){if(aS)return Nd;aS=1;function t(e){const n="[a-z][a-zA-Z0-9_]*",r={className:"string",begin:"\\$.{1}...

High

Shell

Package source references shell execution.

client/dist/assets/index-Yf8uu-wW.jsView on unpkg · L112

src/ai-manager.jsView file

Lines 61-101javascript

61- GUNAKAN indentasi spasi untuk sub-item, bukan markdown nested list

62- Untuk kode, cukup tulis kode langsung tanpa backtick fence jika konteksnya jelas

63- Tulis plain text yang bersih, to the point, dan mudah dibaca di terminal

64

65Contoh SALAH:

66**Kemampuan utama:**

67

src/server.jsView file

Lines 1477-1517javascript

1477

1478// POST /api/job-agent/sessions/:id/start — mulai crawl & apply

1479app.post('/api/job-agent/sessions/:id/start', asyncHandler(async (req, res) => {

1480 const id = Number

src/tools/job-agent.jsView file

Lines 101-141javascript

101 for (const mapping of FIELD_MAP) {

102 if (mapping.patterns.some(p => p.test(normalized))) {

103 const value