@aroman22/codegraph-vba-darwin-x64@1.7.1: Suspicious npm security | LPM Firewall

Loading npm security reports…

@aroman22/codegraph-vba-darwin-x64@1.7.1: Suspicious npm security | LPM Firewall

Source & flagged code

8 flagged · loading source

lib/dist/upgrade/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aroman22/codegraph-vba-darwin-x64@1.6.1 matchedIdentity = npm:[redacted]:1.6.1 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dist/upgrade/index.jsView on unpkg

85const https = __importStar(require("https")); L86: const child_process_1 = require("child_process"); L87: exports.REPO = 'ardelperal/codegraph-vba';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L85

lib/dist/bin/codegraph.jsView file

94// eslint-disable-next-line @typescript-eslint/no-implied-eval L95: const importESM = new Function('specifier', 'return import(specifier)'); L96: // Block CodeGraph on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

lib/dist/bin/codegraph.jsView on unpkg · L94

lib/dist/ui/shimmer-worker.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const worker_threads_1 = require("worker_threads"); L4: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/dist/ui/shimmer-worker.jsView on unpkg · L2

lib/dist/upgrade/index.js#virtual:normalized:round1View file

84const path = __importStar(require("path")); L85: const https = __importStar(require("https")); L86: const child_process_1 = require("child_process"); L87: exports.REPO = 'ardelperal/codegraph-vba'; ... L159: const repoRoot = P.resolve(binDir, '..', '..'); L160: if (exists(P.join(repoRoot, 'package.json')) && exists(P.join(repoRoot, '.git'))) { L161: return { kind: 'source', root: repoRoot }; ... L262: const res = await httpsGet(`https://api.github.com/repos/${repo}/releases/latest`, { 'User-Agent': 'codegraph-upgrade', Accept: 'application/vnd.github+json' }, timeoutMs); L263: const tag = JSON.parse(res.body)?.tag_name; L264: if (typeof tag === 'string' && tag) ... L289: /** L290: * Returns the process exit code (0 = success / nothing to do, 1 = failure).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/dist/upgrade/index.js#virtual:normalized:round1View on unpkg · L84

lib/dist/installer/index.jsView file

128// wedged npm can't hang the interactive installer forever (#1139). L129: (0, child_process_1.execSync)('npm install -g @aroman22/codegraph-vba', { stdio: 'pipe', windowsHide: true, timeout: 120_000 }); L130: s.stop('Installed codegraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dist/installer/index.jsView on unpkg · L128

•path = node kind = native_binary sizeBytes = 122894848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

nodeView on unpkg

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

Source & flagged code

8 flagged

lib/dist/upgrade/index.jsView file

Lines 65-105javascript

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.verifyResolvedVersion = verifyResolvedVersion;

74exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

75exports.npmInvocation = npmInvocation;

76exports.resolveNpmGlobalRoot = resolveNpmGlobalRoot;

77exports.findOrphanStagings = findOrphanStagings;

78exports.cleanupOrphanStagings = cleanupOrphanStagings;

79exports.readInstalledPackageVersion = readInstalledPackageVersion;

80exports.hasCommand = hasCommand;

81exports.defaultRun = defaultRun;

82exports.defaultCapture = defaultCapture;

83const fs = __importStar(require("fs"));

84const path = __importStar(require("path"));

85const https = __importStar(require("https"));

86const child_process_1 = require("child_process");

87exports.REPO = 'ardelperal/codegraph-vba';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L85

88exports.NPM_PACKAGE = '@aroman22/codegraph-vba';

89const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

90exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

91function toPosix(p) {

92 return p.replace(/\\/g, '/');

93}

94/**

95 * Where the bundle installer keeps its install root, derived from the bundle

96 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

97 * the layout isn't the one the installer creates (then the installer falls

98 * back to its own default).

99 *

100 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

101 * windows: <installDir>\current (bundleRoot) → <installDir>

102 */

103function deriveInstallDir(bundleRoot, os, exists) {

104 // Use the TARGET platform's path semantics (not the host's), so this is

105 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

•matchType = previous_version_dangerous_delta matchedPackage = @aroman22/codegraph-vba-darwin-x64@1.6.1 matchedIdentity = npm:[redacted]:1.6.1 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dist/upgrade/index.jsView on unpkg

lib/dist/bin/codegraph.jsView file

Lines 74-114javascript

74const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

75const command_supervision_1 = require("./command-supervision");

76const extraction_version_1 =

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1

lib/dist/upgrade/index.js#virtual:normalized:round1View file

84const path = __importStar(require("path")); L85: const https = __importStar(require("https")); L86: const child_process_1 = require("child_process"); L87: exports.REPO = 'ardelperal/codegraph-vba'; ... L159: const repoRoot = P.resolve(binDir, '..', '..'); L160: if (exists(P.join(repoRoot, 'package.json')) && exists(P.join(repoRoot, '.git'))) { L161: return { kind: 'source', root: repoRoot }; ... L262: const res = await httpsGet(`https://api.github.com/repos/${repo}/releases/latest`, { 'User-Agent': 'codegraph-upgrade', Accept: 'application/vnd.github+json' }, timeoutMs); L263: const tag = JSON.parse(res.body)?.tag_name; L264: if (typeof tag === 'string' && tag) ... L289: /** L290: * Returns the process exit code (0 = success / nothing to do, 1 = failure).

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/dist/upgrade/index.js#virtual:normalized:round1View on unpkg · L84

lib/dist/installer/index.jsView file

Lines 108-148javascript

108 if (targets.length === 0) {

109 clack.outro('No agent targets selected — nothing to do.');

110 return;

111 }

112 // Step 2: install the codegraph npm package on PATH (always offered;

•path = node kind = native_binary sizeBytes = 122894848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

nodeView on unpkg

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg