@adhdev/daemon-standalone@1.0.5: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@adhdev/daemon-standalone@1.0.5: Suspicious npm security report | LPM Firewall

Source & flagged code

4 flagged

package.jsonView file

Lines 1-32json

1{

2 "name": "@adhdev/daemon-standalone",

3 "version": "1.0.5",

4 "description": "ADHDev standalone daemon — embedded HTTP/WS server for local dashboard",

5 "main": "dist/index.js",

6 "bin": {

7 "adhdev-standalone": "./dist/index.js",

8 "adhdev": "./dist/index.js",

9 "adhdev-mcp": "./vendor/mcp-server/index.js"

10 },

11 "scripts": {

12 "preinstall": "node -e \"const major=Number.parseInt(process.versions.node.split('.')[0],10); if (process.platform === 'win32' && major >= 24 && !process.env.ADHDEV_BOOTSTRAP && !process.env.CI) { console.error('\\n✗ ADHDev standalone does not currently support Node.js 24+ on Windows.\\n Install Node.js 22.x on Windows, then retry.\\n'); process.exit(1); }\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L12

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L12

13 "build": "tsup",

14 "bundle:web": "node -e \"const{cpSync,mkdirSync,rmSync}=require('fs');rmSync('public',{recursive:true,force:true});mkdirSync('public',{recursive:true});cpSync('../web-standalone/dist','public',{recursive:true});console.log('bundled web-standalone → public/ (clean)')\"",

15 "bundle:vendor": "node ./scripts/vendor-runtime-deps.mjs",

16 "dev": "tsx src/index.ts",

17 "start": "node dist/index.js",

18 "test": "node --import tsx --test test/*.test.ts && vitest run",

19 "typecheck": "tsc --noEmit -p tsconfig.json",

20 "prepublishOnly": "cd ../.. && npm run build -w packages/session-host-daemon && npm run build -w packages/mcp-server && npm run build -w packages/daemon-core && npm run build -w packages/web-standalone && cd packages/daemon-standalone && npm run bundle:web && npm run bundle:vendor && npm run build"

21 },

22 "files": [

23 "dist",

24 "public",

25 "vendor",

26 "README.md"

27 ],

28 "publishConfig": {

29 "access": "public"

30 },

31 "keywords": [

32 "adhdev",

dist/index.jsView file

•path = dist/index.js kind = oversized_source_file sizeBytes = 4810402 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/index.jsView on unpkg

•path = dist/index.js kind = oversized_cli_entrypoint sizeBytes = 4810402 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/index.jsView on unpkg