@aroman22/codegraph-vba-win32-arm64@1.6.0: Suspicious npm | LPM Firewall

Loading npm security reports…

@aroman22/codegraph-vba-win32-arm64@1.6.0: Suspicious npm | LPM Firewall

Source & flagged code

8 flagged · loading source

lib/dist/upgrade/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aroman22/codegraph-vba-win32-arm64@1.5.2 matchedIdentity = npm:[redacted]:1.5.2 similarity = 0.533 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dist/upgrade/index.jsView on unpkg

81const https = __importStar(require("https")); L82: const child_process_1 = require("child_process"); L83: exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L81

lib/dist/bin/codegraph.jsView file

94// eslint-disable-next-line @typescript-eslint/no-implied-eval L95: const importESM = new Function('specifier', 'return import(specifier)'); L96: // Block CodeGraph on Node.js 25.x — V8's turboshaft WASM JIT has a Zone

High

Eval

Package source references dynamic code evaluation.

lib/dist/bin/codegraph.jsView on unpkg · L94

lib/dist/ui/shimmer-worker.jsView file

2Object.defineProperty(exports, "__esModule", { value: true }); L3: const worker_threads_1 = require("worker_threads"); L4: const fs_1 = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/dist/ui/shimmer-worker.jsView on unpkg · L2

lib/dist/installer/index.jsView file

128// wedged npm can't hang the interactive installer forever (#1139). L129: (0, child_process_1.execSync)('npm install -g @colbymchenry/codegraph', { stdio: 'pipe', windowsHide: true, timeout: 120_000 }); L130: s.stop('Installed codegraph CLI on PATH');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/dist/installer/index.jsView on unpkg · L128

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 81025864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg

Source & flagged code

8 flagged

lib/dist/upgrade/index.jsView file

Lines 61-101javascript

61exports.INSTALL_SH_URL = exports.NPM_PACKAGE = exports.REPO = void 0;

62exports.deriveInstallDir = deriveInstallDir;

63exports.detectInstallMethod = detectInstallMethod;

64exports.parseSemver = parseSemver;

65exports.compareVersions = compareVersions;

66exports.isUpdateAvailable = isUpdateAvailable;

67exports.normalizeVersion = normalizeVersion;

68exports.stripV = stripV;

69exports.parseLatestTagFromLocation = parseLatestTagFromLocation;

70exports.resolveLatestVersion = resolveLatestVersion;

71exports.reindexAdvisory = reindexAdvisory;

72exports.runUpgrade = runUpgrade;

73exports.verifyResolvedVersion = verifyResolvedVersion;

74exports.buildWindowsUpgradeScript = buildWindowsUpgradeScript;

75exports.npmInvocation = npmInvocation;

76exports.hasCommand = hasCommand;

77exports.defaultRun = defaultRun;

78exports.defaultCapture = defaultCapture;

79const fs = __importStar(require("fs"));

80const path = __importStar(require("path"));

81const https = __importStar(require("https"));

82const child_process_1 = require("child_process");

83exports.REPO = 'ardelperal/codegraph';

High

Child Process

Package source references child process execution.

lib/dist/upgrade/index.jsView on unpkg · L81

84exports.NPM_PACKAGE = 'codegraph-vba';

85const RAW_BASE = `https://raw.githubusercontent.com/${exports.REPO}/main`;

86exports.INSTALL_SH_URL = `${RAW_BASE}/install.sh`;

87function toPosix(p) {

88 return p.replace(/\\/g, '/');

89}

90/**

91 * Where the bundle installer keeps its install root, derived from the bundle

92 * dir so an upgrade reuses a custom `CODEGRAPH_INSTALL_DIR`. Returns null when

93 * the layout isn't the one the installer creates (then the installer falls

94 * back to its own default).

95 *

96 * unix: <installDir>/versions/<vX.Y.Z> (bundleRoot) → <installDir>

97 * windows: <installDir>\current (bundleRoot) → <installDir>

98 */

99function deriveInstallDir(bundleRoot, os, exists) {

100 // Use the TARGET platform's path semantics (not the host's), so this is

101 // deterministic when reasoning about a Windows layout from a POSIX host (CI)

•matchType = previous_version_dangerous_delta matchedPackage = @aroman22/codegraph-vba-win32-arm64@1.5.2 matchedIdentity = npm:[redacted]:1.5.2 similarity = 0.533 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/dist/upgrade/index.jsView on unpkg

lib/dist/bin/codegraph.jsView file

Lines 74-114javascript

74const wasm_runtime_flags_1 = require("../extraction/wasm-runtime-flags");

75const command_supervision_1 = require("./command-supervision");

76const extraction_version_1 =

lib/dist/ui/shimmer-worker.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const worker_threads_1 = require("worker_threads");

4const fs_1

lib/dist/installer/index.jsView file

Lines 108-148javascript

108 if (targets.length === 0) {

109 clack.outro('No agent targets selected — nothing to do.');

110 return;

111 }

112 // Step 2: install the codegraph npm package on PATH (always offered;

node.exeView file

•path = node.exe kind = native_binary sizeBytes = 81025864 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

node.exeView on unpkg

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView file

•path = lib/dist/extraction/wasm/tree-sitter-terraform.wasm kind = wasm_module sizeBytes = 92484 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/dist/extraction/wasm/tree-sitter-terraform.wasmView on unpkg

bin/codegraph.cmdView file

•path = bin/codegraph.cmd kind = build_helper sizeBytes = 75 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/codegraph.cmdView on unpkg