@addai/node@0.27.0: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@addai/node@0.27.0: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-pty-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/command-runner.jsView file

46exports.wake = wake; L47: const child_process_1 = require("child_process"); L48: const crypto = __importStar(require("crypto"));

High

Child Process

Package source references child process execution.

dist/command-runner.jsView on unpkg · L46

dist/flows/engine-loader.jsView file

21exports.engineLoaded = engineLoaded; L22: const dynamicImport = new Function('specifier', 'return import(specifier);'); L23: let cached = null;

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/flows/engine-loader.jsView on unpkg · L21

dist/unpair.jsView file

17exports.disconnectNode = disconnectNode; L18: const supabase_client_1 = require("./supabase-client"); L19: const store_1 = require("./store");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/unpair.jsView on unpkg · L17

dist/autostart-win.jsView file

13Trigger-reachable persistence chain: scripts.start -> dist/cli.js -> dist/autostart.js -> dist/autostart-win.js L13: // L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere el

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

dist/autostart-win.jsView on unpkg · L13

13// L14: // The task is registered from generated XML rather than `schtasks` flags, L15: // because the settings that decide whether it ever runs are not reachable ... L59: const path = __importStar(require("path")); L60: const child_process_1 = require("child_process"); L61: const autostart_1 = require("./autostart"); ... L71: * username is ambiguous on a machine joined to one. */ L72: function currentUserId(env = process.env) { L73: const user = env.USERNAME || os.userInfo().username; L74: const dom = env.USERDOMAIN; ... L81: * behaves, instead of being wedged into a VBS string or a `schtasks` argument. L82: * The redirect matters: headless stdout on Windows has nowhere else to go, and

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/autostart-win.jsView on unpkg · L13

dist/desktop/open-viewer.jsView file

12// browser viewer is the honest fallback. L13: const child_process_1 = require("child_process"); L14: /** What we would run, as a pure value, so the choice is testable without L15: * launching anything. */ L16: function viewerCommand(platform, t, studioBase = 'https://entities.add.ai') { L17: if (platform === 'darwin' && t.vncPort) { ... L28: function openViewer(t) { L29: const cmd = viewerCommand(process.platform, t); L30: if (!cmd)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/desktop/open-viewer.jsView on unpkg · L12

dist/codex-spawn.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. cannot send custom headers, so ${creds.length - 1} other credential ` + `field(s) were dropped`); } } toml += '\n'; continue; } // on native windows, registry commands like `npx` are .cmd shims that // codex can't createprocess directly — wrap with `cmd /c` (no-op on posix). const wrapped = (0, win_1.wrapmcpcommandforplatform)(s.command, array.isarray(s.args) ? s.args : []); toml += `[mcp_servers.${tomlstring(s.slug).slice(1, -1)}]\n`; toml += `command = ${tomlstring(wrapped.command)}\n`; if (wrapped.args.length > 0) { toml += `args = [$

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/codex-spawn.jsView on unpkg

dist/self-update.jsView file

66exports.spawnReplacement = spawnReplacement; L67: const child_process_1 = require("child_process"); L68: const fs = __importStar(require("fs")); ... L75: * L76: * npx caches each invocation under `<npm-cache>/_npx/<hash>/node_modules/…`, L77: * so that segment is the reliable npx tell on every platform (checked first:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L66

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/kimi-spawn.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/node@0.26.0 matchedIdentity = npm:QGFkZGFpL25vZGU:0.26.0 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/kimi-spawn.jsView on unpkg

Source & flagged code

11 flagged

package.jsonView file

Lines 25-62json

25 },

26 "type": "commonjs",

27 "main": "dist/index.js",

28 "bin": {

29 "ainode": "dist/cli.js"

30 },

31 "publishConfig": {

32 "access": "public"

33 },

34 "files": [

35 "dist",

36 "scripts",

37 "README.md"

38 ],

39 "scripts": {

40 "build": "tsc -p tsconfig.json",

41 "start": "node dist/cli.js",

42 "dev": "tsc -p tsconfig.json && node dist/cli.js",

43 "test": "npm run build && node --test test/*.test.mjs",

44 "clean": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\"",

45 "postinstall": "node scripts/fix-pty-helper.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

46 "prepublishOnly": "npm run build"

47 },

48 "engines": {

49 "node": ">=18"

50 },

51 "dependencies": {

52 "@addai/node-flows": "^1.0.0",

53 "node-pty": "^1.1.0",

54 "ws": "^8.21.3"

55 },

56 "devDependencies": {

57 "@types/node": "^20.0.0",

58 "@types/ws": "^8.18.1",

59 "typescript": "^5.6.0"

60 }

61}

62

dist/command-runner.jsView file

Lines 26-66javascript

26});

27var __importStar = (this && this.__importStar) || (function () {

28 var ownKeys = function(o) {

dist/flows/engine-loader.jsView file

Lines 1-41javascript

1"use strict";

2// Loading an ESM package from a CommonJS daemon.

3//

4// @addai/node-flows is ESM and its sandbox does a top-level `await

5// import('isolated-vm')` — the optional native isolate, probed at load. This

6// daemon compiles to CommonJS, and `require()` refuses an ESM graph with

7// top-level await outright (ERR_REQUIRE_ASYNC_MODULE). So the engine can only

8// ever be loaded asynchronously.

9//

10// The `new Function` is not a trick for its own sake: TypeScript with

dist/unpair.jsView file

Lines 1-37javascript

1"use strict";

2// Disconnecting a node from +Ai.

3//

4// Shared by `ainode unpair` and the console's disconnect key, because the two

5// must not drift: this is the one action that takes work away from people, and

6// a version of it that forgets to cancel in-flight runs would leave whoever

7// was waiting on them waiting forever.

8//

9// The server soft-disables rather than deletes: the runtime row, its history

10// and its chats all survive, the token is scrubbed, and the status becomes

dist/autostart-win.jsView file

Lines 1-33javascript

1"use strict";

2// Windows backend: a Task Scheduler logon task.

3//

4// Three shapes were possible and only this one is both hidden and durable:

5//

6// Startup-folder shortcut — trivial, but pops a console window at every

7// logon and nothing brings the node back if it dies.

8// Windows Service — survives with nobody logged in, but runs outside the

9// user's session: no keychain, no user PATH, no ~/.claude. It would boot

10// a node that fails every run.

dist/desktop/open-viewer.jsView file

Lines 1-32javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.viewerCommand = viewerCommand;

4exports.openViewer = openViewer;

5// Open a desktop in whatever this machine calls a screen viewer.

6

dist/codex-spawn.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. cannot send custom headers, so ${creds.length - 1} other credential ` + `field(s) were dropped`); } } toml += '\n'; continue; } // on native windows, registry commands like `npx` are .cmd shims that // codex can't createprocess directly — wrap with `cmd /c` (no-op on posix). const wrapped = (0, win_1.wrapmcpcommandforplatform)(s.command, array.isarray(s.args) ? s.args : []); toml += `[mcp_servers.${tomlstring(s.slug).slice(1, -1)}]\n`; toml += `command = ${tomlstring(wrapped.command)}\n`; if (wrapped.args.length > 0) { toml += `args = [$

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/codex-spawn.jsView on unpkg

dist/self-update.jsView file

Lines 46-86javascript

46 return function (mod) {

47 if (mod && mod.__esModule) return mod;

48 var result = {};

49 if (mod != null

scripts/smoke-test.shView file

•path = scripts/smoke-test.sh kind = build_helper sizeBytes = 2409 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/smoke-test.shView on unpkg

dist/kimi-spawn.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @addai/node@0.26.0 matchedIdentity = npm:QGFkZGFpL25vZGU:0.26.0 similarity = 0.990 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/kimi-spawn.jsView on unpkg