zam-core@0.16.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

zam-core@0.16.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

dist/copilot-extension/mcp-client.bundle.mjsView file

5|| (${i} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,I._)`+${n}`);return;case"boolean":o.elseIf((0,I._)`${n} === "false" || ${n} === 0 || ${n} === null`).as... L6: || ${i} === "boolean" || ${n} === null`).assign(a,(0,I._)`[${n}]`)}}}function T$({gen:t,parentData:e,parentDataProperty:r},o){t.if((0,I._)`${e} !== undefined`,()=>t.assign((0,I._)`... L7: missingProperty: ${o},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/copilot-extension/mcp-client.bundle.mjsView on unpkg · L5

dist/vscode-extension/extension.cjsView file

4|| (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,N._)`+${o}`);return;case"boolean":n.elseIf((0,N._)`${o} === "false" || ${o} === 0 || ${o} === null`).as... L5: || ${i} === "boolean" || ${o} === null`).assign(a,(0,N._)`[${o}]`)}}}function nS({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,N._)`${e} !== undefined`,()=>t.assign((0,N._)`... L6: missingProperty: ${n},

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/vscode-extension/extension.cjsView on unpkg · L4

dist/index.jsView file

120import { dirname, join } from "path"; L121: var DEFAULT_CREDENTIALS_PATH = join(homedir(), ".zam", "credentials.json"); L122: function loadCredentials(path) { ... L125: try { L126: return JSON.parse(readFileSync(p, "utf-8")); L127: } catch { ... L138: } L139: if (process.platform !== "win32" && (path === void 0 || createdDirectory)) { L140: chmodSync(dir, 448); ... L231: }; L232: const wiqlRes = await fetch(wiqlUrl, { L233: method: "POST",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L120

120import { dirname, join } from "path"; L121: var DEFAULT_CREDENTIALS_PATH = join(homedir(), ".zam", "credentials.json"); L122: function loadCredentials(path) { ... L125: try { L126: return JSON.parse(readFileSync(p, "utf-8")); L127: } catch { ... L138: } L139: if (process.platform !== "win32" && (path === void 0 || createdDirectory)) { L140: chmodSync(dir, 448); ... L231: }; L232: const wiqlRes = await fetch(wiqlUrl, { L233: method: "POST",

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/index.jsView on unpkg · L120

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView file

•path = dist/vscode-extension/ZAM_Companion_0.16.0.vsix kind = high_entropy_blob sizeBytes = 123892 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView on unpkg

•path = dist/vscode-extension/ZAM_Companion_0.16.0.vsix kind = compressed_blob sizeBytes = 123892 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView on unpkg

•path = dist/vscode-extension/ZAM_Companion_0.16.0.vsix kind = nested_archive_needs_inspection sizeBytes = 123892 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView on unpkg

dist/cli/commands/mcp.jsView file

•path = dist/cli/commands/mcp.js kind = oversized_source_file sizeBytes = 2592838 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli/commands/mcp.jsView on unpkg

Source & flagged code

8 flagged

dist/copilot-extension/mcp-client.bundle.mjsView file

Lines 1-25javascript

1import { createRequire } from "node:module"; const require = createRequire(import.meta.url);

2var fg=Object.create;var Zn=Object.defineProperty;var mg=Object.getOwnPropertyDescriptor;var hg=Object.getOwnPropertyNames;var gg=Object.getPrototypeOf,_g=Object.prototype.hasOwnProperty;var ot=(t=>typeof require<"u"?require:typeof Proxy<"u"?new Proxy(t,{get:(e,r)=>(typeof require<"u"?require:e)[r]}):t)(function(t){if(typeof require<"u")return require.apply(this,arguments);throw Error('Dynamic require of "'+t+'" is not supported')});var v=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}},uc=(t,e)=>{for(var r in e)Zn(t,r,{get:e[r],enumerable:!0})},yg=(t,e, ...

3`:""},this._extScope=e,this._scope=new qe.Scope({parent:e}),this._nodes=[new hi]}toString(){return this._root

4 || (${i} == "string" && ${n} && ${n} == +${n})`).assign(a,(0,I._)`+${n}`);return;case"integer":o.elseIf((0,I._)`${i} === "boolean" || ${

5 || (${i} === "string" && ${n} && ${n} == +${n} && !(${n} % 1))`).assign(a,(0,I._)`+${n}`);return;case"boolean":o.elseIf((0,I._)`${n} === "false"

6 || ${i} === "boolean" || ${n} === null`).assign(a,(0,I._)`[${n}]`)}}}function T$({gen:t,parentData:e,parentDataProperty:r},o){t.if((0,I._)`${e} !== undefined`,()=>t.assign((0,I._)`${e}[${

7 missingProperty: ${o},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/copilot-extension/mcp-client.bundle.mjsView on unpkg · L5

8 depsCount: ${e},

9 deps: ${r}}`};var cz={keyword:"dependencies",type:"object",schemaType:"object",error:He.error,code(t){

10`).filter(i=>i),n=Math.min(...o.map(i=>i.length-i.trimStart().length)),s=o.map(i=>i.slice(n)).map(i=>" ".repeat(this.indent*2)+i);for(let i of s)this.content.push(i)}compile(){let e=Function,r=this?.args,n=[...(this?.content??[""]).map(s=>` ${s}`)];return new e(...r,n.join(`

11`))}};var _u={major:4,minor:4,patch:3};var K=g("$ZodType",(t,e)=>{var r;t??(t={}),t._zod.def=e,t._zod.bag=t._zod.bag||{},t._zod.version=_u;let o=[...t._zod.def.checks??[]];t._zod.traits.has("$ZodCheck")&&o.unshift(t);for(let n of o)for(let s of n._zod.onattach)s(t);if(o.length===0)(r=t._zod).deferred??(r.deferred=[]),t._zod.deferred?.push(()=>{t._zod.run=t._zod.parse});else{let n=(i,a,c)=>{let u=it(i),l;for(let d of a){if(d._zod.def.when){if(Jn(i)||!d._zod.def.when(i))continue}else if(u)continue;let p=i.issues.length,f=d._zod.check(i);if(f instanceof Promise&&c?.async===!1)throw new Ue;if(l||f ...

12 if (${P}.issues.length) {

13 if (${x} in input) {

14 payload.issues = payload.issues.concat(${P}.issues.map(iss => ({

15 ...iss,

16 path: iss.path ? [${x}, ...iss.path] : [${x}]

17 })));

18 }

19 }

20

21 if (${P}.value === undefined) {

22 if (${x} in input) {

23 newResult[${x}] = undefined;

24 }

25 } else {

Long lines were clipped for display.

dist/vscode-extension/extension.cjsView file

Lines 1-24javascript

1"use strict";var j_=Object.create;var xn=Object.defineProperty;var U_=Object.getOwnPropertyDescriptor;var Z_=Object.getOwnPropertyNames;var F_=Object.getPrototypeOf,V_=Object

dist/index.jsView file

Lines 100-140javascript

100 domain: d.domain,

101 totalCards: total,

102 matureCards: mature,

103 avgStability: Math.round(avgStab * 100) / 100,

104

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView file

•path = dist/vscode-extension/ZAM_Companion_0.16.0.vsix kind = high_entropy_blob sizeBytes = 123892 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView on unpkg

•path = dist/vscode-extension/ZAM_Companion_0.16.0.vsix kind = compressed_blob sizeBytes = 123892 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView on unpkg

•path = dist/vscode-extension/ZAM_Companion_0.16.0.vsix kind = nested_archive_needs_inspection sizeBytes = 123892 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

dist/vscode-extension/ZAM_Companion_0.16.0.vsixView on unpkg

dist/cli/commands/mcp.jsView file

•path = dist/cli/commands/mcp.js kind = oversized_source_file sizeBytes = 2592838 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli/commands/mcp.jsView on unpkg