Loading npm security reports…

yh-report@2.4.84: Clean npm security report (Allow) | LPM Firewall

registry / yh-report / 2.4.84

yh-report@2.4.84

AI Security Review

scanned 7d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a Vue report designer/viewer with relative backend API calls and user-invoked custom report logic.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

runtime use of report designer/viewer features

Impact

user-configured custom scripts may execute in the host web app context, but no package-authored exfiltration or persistence was found

Mechanism

package-aligned report rendering, API requests, import/export, and custom report scripting

Rationale

Static inspection shows risky primitives, but they are package-aligned runtime customization features and relative application API calls rather than concrete malicious behavior. There is no lifecycle execution, external exfiltration, filesystem credential access, persistence, or control-surface hijack.

Evidence

package.jsonindex.es.jsindex-CMu5wXAH.mjsStatementDesign-dQXKX8rU.mjsStatementList-CMVQHK5F.mjseditorLock-DdAYyg2u.mjs

Network endpoints10

sysReport/listsysReport/configsysReport/savesysReport/delete/windowDesign/getSelectorList/windowDesign/getDatasourceList/windowDesign/getColumns/report/data/${X}dataLock/lock/${e}dataLock/unlock/${e}

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

index-CMu5wXAH.mjs uses eval for configured report data processing.
index-CMu5wXAH.mjs uses new Function for custom cell rendering.
Browser runtime reads imported JSON files and creates downloadable Blob exports in StatementList-CMVQHK5F.mjs.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks and main only exports bundled Vue components.
Network calls are relative app API routes such as sysReport/*, /report/data/*, /windowDesign/*, and dataLock/*; no external exfiltration host found.
No child_process, shell execution, credential harvesting, npmrc/SSH access, persistence, or AI-agent control-surface mutation found.
Trojan-source hint appears tied to bundled editor/parser Unicode regex/comment content in StatementDesign-dQXKX8rU.mjs, not hidden attack logic.
Dynamic code execution is tied to user-configured report processing/rendering features, not install-time or import-time behavior.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEval

Source & flagged code

2 flagged

StatementDesign-dQXKX8rU.mjsView file

11896contains invisible/control Unicode U+200B (zero width space) --؜<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF￹-]`, Gf), F$ = {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

StatementDesign-dQXKX8rU.mjsView on unpkg · L11896

•Trigger-reachable chain: manifest.main -> index.es.js -> index-CMu5wXAH.mjs -> StatementDesign-dQXKX8rU.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

StatementDesign-dQXKX8rU.mjsView on unpkg

Source & flagged code

2 flagged · loading source

StatementDesign-dQXKX8rU.mjsView file

11896contains invisible/control Unicode U+200B (zero width space) --؜<U+200B><U+200E><U+200F>\u2028\u2029<U+202D><U+202E><U+2066><U+2067><U+2069>\uFEFF￹-]`, Gf), F$ = {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

StatementDesign-dQXKX8rU.mjsView on unpkg · L11896

•Trigger-reachable chain: manifest.main -> index.es.js -> index-CMu5wXAH.mjs -> StatementDesign-dQXKX8rU.mjs Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

StatementDesign-dQXKX8rU.mjsView on unpkg

Findings

2 Critical2 Medium5 Low

CriticalTrojan Source UnicodeStatementDesign-dQXKX8rU.mjs

CriticalTrigger Reachable Dangerous CapabilityStatementDesign-dQXKX8rU.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings