@adhdev/daemon-core: Suspicious npm security report (Warn)

Loading npm security reports…

Source & flagged code

8 flagged

src/mesh/worktree-bootstrap-config.tsView file

Lines 1-22typescript

1import { existsSync, readFileSync } from 'fs';

2import { join, resolve as pathResolve } from 'path';

3import { execFile, execFileSync } from 'node:child_process';

4import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L2

5import { promisify } from 'node:util';

6import * as yaml from 'js-yaml';

7import { resolveWin32Executable, buildWin32ExecFileSpawn } from '../cli-adapters/resolve-executable.js';

8import {

9 isMeshConfigRecord,

10 normalizeMeshCommandConfig,

11 type MeshRefineValidationCommandPlan,

12 type RepoMeshRefineValidationCommandConfig,

13} from './refine-config.js';

14import type { MeshAsyncJobLifecycle } from '../repo-mesh-types.js';

16// 'complete' is the terminal status the coordinator's markWorktreeBootstrapTerminalState

17// (router.ts) stamps when the worktree_bootstrap_complete event fires — distinct from

18// 'ready' (which carries a staleInputs digest from an in-process run). It is terminal and

19// must be recognized as such by evaluateWorktreeBootstrapState so a later re-hydration never

20// round-trips it back to 'stale'/'never_ran'.

Lines 520-560typescript

520 const initiallyAbsent = staleInputPaths.filter(p => !existsSync(join(workspace, p)));

521 for (const command of validation.commands) {

522 // Check if any initially-absent staleInputs files appeared since bootstrap started

src/providers/sdk/v1/sandbox/script-runner.tsView file

Lines 18-58typescript

18 memoryLimitMb: number;

19 /**

20 * Whitelist of global names the script may access.

21 * The full allowed surface is documented in README-design.ts.

22 * Default: ['console', 'JSON', 'Math', 'Date', 'String', 'Number', 'Boolean',

23 * 'Array', 'Object', 'RegExp']

24 */

25 allowedGlobals: string[];

src/mesh/coordinator-registry.tsView file

Lines 87-122typescript

87 * - If the wrapper block was the only thing in the file, delete the

88 * file outright so we don't leave behind an empty AGENTS.md.

89 * - Otherwise drop only the block between the sentinels and trim a

90 * leading

src/providers/sdk/v1/builders/cli/parse-session.tsView file

Lines 1-21typescript

1/**

2 * buildParseSessionFromTui — synthesize a parseSession function from the

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/providers/sdk/v1/builders/cli/parse-session.tsView on unpkg · L1

3 * manifest tui block alone.

4 *

5 * Composition:

6 * 1. detectStatus from tui.spinner/modal/settledPrompt/dispatchOrder

7 * (delegated to buildDetectStatusFromTui)

8 * 2. parseApproval from tui.modal (delegated to buildParseApprovalFromTui)

src/providers/sdk/v1/validators/taint.tsView file

Lines 33-73typescript

33import { resolve, dirname, join } from 'node:path';

35// ─── Findings ──────────────────────────────────────────────────────────

37export type TaintLevel = 'clean' | 'elevated'

src/system/load-better-sqlite3.tsView file

Lines 1-21typescript

1import { createRequire } from 'module';

2import type BetterSqlite3 from 'better-sqlite3';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/system/load-better-sqlite3.tsView on unpkg · L1

4let cached:

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3279275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

8 flagged · loading source

src/mesh/worktree-bootstrap-config.tsView file

2import { join, resolve as pathResolve } from 'path'; L3: import { execFile, execFileSync } from 'node:child_process'; L4: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L2

540// A win32 .cmd/.bat shim (npm/npx/tsc) cannot be exec'd directly — wrap L541: // it in cmd.exe /c (no-op off win32 / for a real .exe). L542: const spawn = buildWin32ExecFileSpawn(resolvedCommand, command.args);

High

Shell

Package source references shell execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L540

src/providers/sdk/v1/sandbox/script-runner.tsView file

38* Implementations: L39: * - DirectEvalRunner — no-op stub; uses eval() with a try/catch (unsafe, no limits). L40: * - IsolatedVmRunner — Phase 5 full implementation using the `isolated-vm` package.

@adhdev/daemon-core: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged

src/mesh/worktree-bootstrap-config.tsView file

Lines 1-22typescript

1import { existsSync, readFileSync } from 'fs';

2import { join, resolve as pathResolve } from 'path';

3import { execFile, execFileSync } from 'node:child_process';

4import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L2

5import { promisify } from 'node:util';

6import * as yaml from 'js-yaml';

7import { resolveWin32Executable, buildWin32ExecFileSpawn } from '../cli-adapters/resolve-executable.js';

8import {

9 isMeshConfigRecord,

10 normalizeMeshCommandConfig,

11 type MeshRefineValidationCommandPlan,

12 type RepoMeshRefineValidationCommandConfig,

13} from './refine-config.js';

14import type { MeshAsyncJobLifecycle } from '../repo-mesh-types.js';

16// 'complete' is the terminal status the coordinator's markWorktreeBootstrapTerminalState

17// (router.ts) stamps when the worktree_bootstrap_complete event fires — distinct from

18// 'ready' (which carries a staleInputs digest from an in-process run). It is terminal and

19// must be recognized as such by evaluateWorktreeBootstrapState so a later re-hydration never

20// round-trips it back to 'stale'/'never_ran'.

Lines 520-560typescript

520 const initiallyAbsent = staleInputPaths.filter(p => !existsSync(join(workspace, p)));

521 for (const command of validation.commands) {

522 // Check if any initially-absent staleInputs files appeared since bootstrap started

src/providers/sdk/v1/sandbox/script-runner.tsView file

Lines 18-58typescript

18 memoryLimitMb: number;

19 /**

20 * Whitelist of global names the script may access.

21 * The full allowed surface is documented in README-design.ts.

22 * Default: ['console', 'JSON', 'Math', 'Date', 'String', 'Number', 'Boolean',

23 * 'Array', 'Object', 'RegExp']

24 */

25 allowedGlobals: string[];

src/mesh/coordinator-registry.tsView file

Lines 87-122typescript

87 * - If the wrapper block was the only thing in the file, delete the

88 * file outright so we don't leave behind an empty AGENTS.md.

89 * - Otherwise drop only the block between the sentinels and trim a

90 * leading

src/providers/sdk/v1/builders/cli/parse-session.tsView file

Lines 1-21typescript

1/**

2 * buildParseSessionFromTui — synthesize a parseSession function from the

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/providers/sdk/v1/builders/cli/parse-session.tsView on unpkg · L1

3 * manifest tui block alone.

4 *

5 * Composition:

6 * 1. detectStatus from tui.spinner/modal/settledPrompt/dispatchOrder

7 * (delegated to buildDetectStatusFromTui)

8 * 2. parseApproval from tui.modal (delegated to buildParseApprovalFromTui)

src/providers/sdk/v1/validators/taint.tsView file

Lines 33-73typescript

33import { resolve, dirname, join } from 'node:path';

35// ─── Findings ──────────────────────────────────────────────────────────

37export type TaintLevel = 'clean' | 'elevated'

src/system/load-better-sqlite3.tsView file

Lines 1-21typescript

1import { createRequire } from 'module';

2import type BetterSqlite3 from 'better-sqlite3';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/system/load-better-sqlite3.tsView on unpkg · L1

4let cached:

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3279275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

@adhdev/daemon-core@1.0.12

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code