@adhdev/daemon-core@1.0.12: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@adhdev/daemon-core@1.0.12: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged · loading source

src/mesh/worktree-bootstrap-config.tsView file

2import { join, resolve as pathResolve } from 'path'; L3: import { execFile, execFileSync } from 'node:child_process'; L4: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L2

540// A win32 .cmd/.bat shim (npm/npx/tsc) cannot be exec'd directly — wrap L541: // it in cmd.exe /c (no-op off win32 / for a real .exe). L542: const spawn = buildWin32ExecFileSpawn(resolvedCommand, command.args);

High

Shell

Package source references shell execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L540

src/providers/sdk/v1/sandbox/script-runner.tsView file

38* Implementations: L39: * - DirectEvalRunner — no-op stub; uses eval() with a try/catch (unsafe, no limits). L40: * - IsolatedVmRunner — Phase 5 full implementation using the `isolated-vm` package.

Low

Eval

Package source references a known benign dynamic code generation pattern.

src/providers/sdk/v1/sandbox/script-runner.tsView on unpkg · L38

src/mesh/coordinator-registry.tsView file

107// eslint-disable-next-line @typescript-eslint/no-require-imports L108: const { stripCoordinatorWrapperFile } = require('../commands/mesh-coordinator.js'); L109: stripCoordinatorWrapperFile(filePath);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/mesh/coordinator-registry.tsView on unpkg · L107

src/providers/sdk/v1/builders/cli/parse-session.tsView file

1/** L2: * buildParseSessionFromTui — synthesize a parseSession function from the

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/providers/sdk/v1/builders/cli/parse-session.tsView on unpkg · L1

src/providers/sdk/v1/validators/taint.tsView file

53| 'process-control' // process.exit, process.kill L54: | 'shell-exec' // child_process.{exec,execSync,spawn,spawnSync,fork} L55: | 'fs-write' // fs.writeFile / writeFileSync outside override dir L56: | 'fs-read' // fs.readFile / readFileSync L57: | 'network' // http(s).request, fetch, net.connect, dgram L58: | 'dynamic-codegen' // eval, new Function(), Function('...') ... L60: | 'obfuscation' // Buffer.from(...,'base64').toString + (eval|Function) L61: | 'global-mutation'; // mutating Object.prototype, process.env L62:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/providers/sdk/v1/validators/taint.tsView on unpkg · L53

src/system/load-better-sqlite3.tsView file

1package = @adhdev/daemon-core; repositoryIdentity = adhdev; dependency = better-sqlite3 L1: import { createRequire } from 'module'; L2: import type BetterSqlite3 from 'better-sqlite3'; L3:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/system/load-better-sqlite3.tsView on unpkg · L1

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3279275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

Source & flagged code

8 flagged

src/mesh/worktree-bootstrap-config.tsView file

Lines 1-22typescript

1import { existsSync, readFileSync } from 'fs';

2import { join, resolve as pathResolve } from 'path';

3import { execFile, execFileSync } from 'node:child_process';

4import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

src/mesh/worktree-bootstrap-config.tsView on unpkg · L2

5import { promisify } from 'node:util';

6import * as yaml from 'js-yaml';

7import { resolveWin32Executable, buildWin32ExecFileSpawn } from '../cli-adapters/resolve-executable.js';

8import {

9 isMeshConfigRecord,

10 normalizeMeshCommandConfig,

11 type MeshRefineValidationCommandPlan,

12 type RepoMeshRefineValidationCommandConfig,

13} from './refine-config.js';

14import type { MeshAsyncJobLifecycle } from '../repo-mesh-types.js';

15

16// 'complete' is the terminal status the coordinator's markWorktreeBootstrapTerminalState

17// (router.ts) stamps when the worktree_bootstrap_complete event fires — distinct from

18// 'ready' (which carries a staleInputs digest from an in-process run). It is terminal and

19// must be recognized as such by evaluateWorktreeBootstrapState so a later re-hydration never

20// round-trips it back to 'stale'/'never_ran'.

21export type WorktreeBootstrapStatus = 'ready' | 'complete' | 'running' | 'failed' | 'not_configured' | 'disabled' | 'stale';

22

Lines 520-560typescript

520 const initiallyAbsent = staleInputPaths.filter(p => !existsSync(join(workspace, p)));

521 for (const command of validation.commands) {

522 // Check if any initially-absent staleInputs files appeared since bootstrap started

src/providers/sdk/v1/sandbox/script-runner.tsView file

Lines 18-58typescript

18 memoryLimitMb: number;

19 /**

20 * Whitelist of global names the script may access.

21 * The full allowed surface is documented in README-design.ts.

22 * Default: ['console', 'JSON', 'Math', 'Date', 'String', 'Number', 'Boolean',

23 * 'Array', 'Object', 'RegExp']

24 */

25 allowedGlobals: string[];

src/mesh/coordinator-registry.tsView file

Lines 87-122typescript

87 * - If the wrapper block was the only thing in the file, delete the

88 * file outright so we don't leave behind an empty AGENTS.md.

89 * - Otherwise drop only the block between the sentinels and trim a

90 * leading

src/providers/sdk/v1/builders/cli/parse-session.tsView file

Lines 1-21typescript

1/**

2 * buildParseSessionFromTui — synthesize a parseSession function from the

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/providers/sdk/v1/builders/cli/parse-session.tsView on unpkg · L1

3 * manifest tui block alone.

4 *

5 * Composition:

6 * 1. detectStatus from tui.spinner/modal/settledPrompt/dispatchOrder

7 * (delegated to buildDetectStatusFromTui)

8 * 2. parseApproval from tui.modal (delegated to buildParseApprovalFromTui)

src/providers/sdk/v1/validators/taint.tsView file

Lines 33-73typescript

33import { resolve, dirname, join } from 'node:path';

34

35// ─── Findings ──────────────────────────────────────────────────────────

36

37export type TaintLevel = 'clean' | 'elevated'

src/system/load-better-sqlite3.tsView file

Lines 1-21typescript

1import { createRequire } from 'module';

2import type BetterSqlite3 from 'better-sqlite3';

3

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

src/system/load-better-sqlite3.tsView on unpkg · L1

4let cached:

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 3279275 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg