@ashx-j/lunr: Suspicious npm security report (Warn)

Loading npm security reports…

@ashx-j/lunr: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

25 flagged

package.jsonView file

Lines 15-55json

15 "exports": {

16 ".": {

17 "types": "./dist/index.d.ts",

18 "import": "./dist/node-runtime/index.js"

19 },

20 "./rpc-entry": {

21 "import": "./dist/rpc.js"

22 }

23 },

24 "files": [

25 "dist",

26 "docs",

27 "native/computer-use/LICENSE.md",

28 "scripts/install-browser.mjs",

29 "examples",

30 "CHANGELOG.md",

31 "npm-shrinkwrap.json",

32 "install-lock"

33 ],

34 "scripts": {

35 "postinstall": "node scripts/install-browser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "clean": "shx rm -rf dist",

37 "build": "node ../../scripts/generate-computer-use-manifest.mjs && tsgo -p tsconfig.build.json && shx chmod +x dist/cli.js dist/rpc-entry.js && npm run copy-assets && node ../../scripts/build-node-runtime.mjs",

38 "build:binary": "npm --prefix ../tui run build && tsgo -p ../ai/tsconfig.build.json && npm --prefix ../agent run build && npm run build && node ../../scripts/build-standalone.mjs --outfile dist/lunr && npm run copy-binary-assets",

39 "copy-assets": "shx mkdir -p dist/modes/interactive/theme && shx cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && shx mkdir -p dist/modes/interactive/assets && shx cp src/modes/interactive/assets/*.png dist/modes/interactive/assets/ && shx mkdir -p dist/core/export-html/vendor && shx cp src/core/export-html/template.html src/core/export-html/template.css src/core/export-html/template.js dist/core/export-html/ && shx cp src/core/export-html/vendor/*.js dist/core/export-html/vendor/ && shx mkdir -p dist/builtin-extensions/lunr-skill-creator/skills/skill-creator && shx cp ...

40 "copy-binary-assets": "shx cp package.json dist/ && shx cp README.md dist/ && shx cp CHANGELOG.md dist/ &&

41 "test": "vitest --run",

42 "shrinkwrap": "node ../../scripts/generate-coding-agent-shrinkwrap.mjs"

43 },

44 "dependencies": {

45 "@ashx-j/lunr-agent": "^0.2.28",

46 "@ashx-j/lunr-ai": "^0.2.28",

47 "@ashx-j/lunr-tui": "^0.2.28",

48 "@modelcontextprotocol/ext-apps": "1.7.4",

49 "@modelcontextprotocol/sdk": "1.30.0",

50 "@mozilla/readability": "0.6.0",

51 "@silvia-odwyer/photon-node": "0.3.4",

52 "@sinclair/typebox": "npm:typebox@1.1.38",

53 "chalk": "5.6.2",

54 "cross-spawn": "7.0.6",

55 "croner": "10.0.1",

Long lines were clipped for display.

dist/node-runtime/chunk-2VIW3IMF.jsView file

20396patternName = generic_password severity = medium line = 20396

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/node-runtime/chunk-2VIW3IMF.jsView on unpkg · L20396

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

Lines 974-1014javascript

974 ...childReports.flatMap((report) => report.residualRisks ?? []),

975 ...blockers.map((result) => `${result.agent}: ${

dist/node-runtime/chunk-VSUEAI7O.jsView file

Lines 2234-2274javascript

2234 // TODO can its length be used as dataLevel if nil is removed?

2235 dataLevel: 0,

2236 dataTypes: [],

2237 definedProperties: /* @__PURE__ */ new Set(),

2238 topSchemaRef

dist/modes/interactive/theme/theme.jsView file

Lines 1-31javascript

1import * as fs from "node:fs";

2import { createRequire } from "node:module";

3import * as path from "node:path";

dist/core/rollback.jsView file

Lines 7-47javascript

7 * unlike /undo and /edit, which stay in the same session file).

8 *

9 * Capture modes (setting `rollbackCapture`):

10 * - copies: snapshot pre

dist/node-runtime/chunk-EBLAZVSA.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/node-runtime/chunk-EBLAZVSA.js: authorization_servers: array(SafeUrlSchema).optional(), authorization_details_types_supported: array(string()).optional(), authorization_endpoint: SafeUrlSchema, authorization_endpoint: SafeUrlSchema, var AUTHORIZATION_CODE_RESPONSE_TYPE = "code", AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256"; headers.set("Authorization", `Basic ${credentials}`); async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) { let cachedState = await provider.discoveryState?.(), resourceMetadata, authorizationServerUrl, metadata, effectiveResourceMetadataUrl = resourceMet

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/node-runtime/chunk-EBLAZVSA.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.jsView file

Lines 1-22javascript

1var createDoomModule = (() => {

2 var _scriptName = typeof document != 'undefined' ? document.currentScript?.src : undefined;

3 if

dist/node-runtime/pi-prompt-template-model-FTGELLS5.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. .thinkinglevels ? prompt.thinkinglevels.join(",") : prompt.thinking, thinkinglabel = thinkingvalue ? ` ${thinkingvalue}` : "", looplabel = prompt.loop !== void 0 ? ` loop:${prompt.loop === null ? "unlimited" : prompt.loop}` : "", boomeranglabel = prompt.boomerang ? " boomerang" : "", subagentlabel = prompt.subagent ? ` subagent:${prompt.subagent === !0 ? "delegate" : prompt.subagent}` : "", parallellabel = prompt.parallel !== void 0 ? ` parallel:${prompt.parallel}` : "", deterministiclabel = prompt.deterministic ? ` deterministic-step:${prompt.deterministic.handoff}` : "", workerslabel = prompt.workers ? ` workers:${effectivelineupcount(prompt.workers)}` : "", reviewerslabel = p

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/node-runtime/pi-prompt-template-model-FTGELLS5.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/tree-sitter/pattern-compiler.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/tree-sitter/pattern-compiler.js#virtual:normalized:round1View on unpkg

dist/node-runtime/chunk-ES6PBSIE.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-CSFI6YXL.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-ES6PBSIE.jsView on unpkg

dist/builtin-extensions/pi-intercom/broker/spawn.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/builtin-extensions/pi-intercom/broker/spawn.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-intercom/broker/spawn.jsView on unpkg

dist/node-runtime/chunk-Q4Q6D4IY.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-Q4Q6D4IY.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-Q4Q6D4IY.jsView on unpkg

dist/utils/shell.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/shell.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = [redacted]-editor.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/node-runtime/chunk-UNUZICC4.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-IRPJXI6U.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-UNUZICC4.jsView on unpkg

dist/node-runtime/chunk-XTHQ7XR7.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-XTHQ7XR7.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-XTHQ7XR7.jsView on unpkg

dist/node-runtime/brave-2AFFAXNN.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/brave-UWDA3I22.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/brave-2AFFAXNN.jsView on unpkg

dist/node-runtime/chunk-2SWW7KMW.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-XBWPBZBN.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-2SWW7KMW.jsView on unpkg

dist/node-runtime/chunk-3WFAEVKS.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-3WFAEVKS.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-3WFAEVKS.jsView on unpkg

dist/node-runtime/chunk-Q5ZU2VRT.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/chunk-Q5ZU2VRT.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-Q5ZU2VRT.jsView on unpkg

dist/node-runtime/exa-6VBZNPGE.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/node-runtime/exa-LL64QZR2.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/exa-6VBZNPGE.jsView on unpkg

Source & flagged code

25 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-browser.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist/node-runtime/chunk-2VIW3IMF.jsView file

20396patternName = generic_password severity = medium line = 20396

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/node-runtime/chunk-2VIW3IMF.jsView on unpkg · L20396

dist/core/exec.jsView file

3*/ L4: import { spawn } from "node:child_process"; L5: import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

994env: { ...process.env, ...(command.env ?? {}) }, L995: shell: true, L996: stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView on unpkg · L994

dist/node-runtime/chunk-VSUEAI7O.jsView file

2254sourceCode = `${gen.scopeRefs(names_1.default.scope)}return ${validateCode}`, this.opts.code.process && (sourceCode = this.opts.code.process(sourceCode, sch)); L2255: let validate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode)(this, this.scope.get()); L2256: if (this.scope.value(validateName, { ref: validate }), validate.errors = null, validate.schema = sch.schema, validate.schemaEnv = sch, sch.$async && (validate.$async = !0), this.op...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/node-runtime/chunk-VSUEAI7O.jsView on unpkg · L2254

dist/modes/interactive/theme/theme.jsView file

11// ============================================================================ L12: const require = createRequire(import.meta.url); L13: // The shipped moon theme needs no schema compiler. Load validation only when

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/modes/interactive/theme/theme.jsView on unpkg · L11

dist/core/rollback.jsView file

27*/ L28: import { spawnSync } from "node:child_process"; L29: import { createHash } from "node:crypto"; ... L34: import { writeSessionJson } from "./session-ownership.js"; L35: const ROLLBACK_BASE = join(homedir(), ".lunr", "rollback"); L36: const contexts = new Map(); ... L226: }); L227: if (!headSrc.error && headSrc.status === 0 && headSrc.stdout) { L228: turn.files.set(sourceAbs, { ... L331: try { L332: const parsed = JSON.parse(readFileSync(path, "utf-8")); L333: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/rollback.jsView on unpkg · L27

dist/node-runtime/chunk-EBLAZVSA.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/node-runtime/chunk-EBLAZVSA.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});var ENVIRONM... L9:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

examples/extensions/doom-overlay/doom/build/doom.jsView on unpkg · L7

dist/node-runtime/pi-prompt-template-model-FTGELLS5.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/node-runtime/pi-prompt-template-model-FTGELLS5.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/tree-sitter/pattern-compiler.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/tree-sitter/pattern-compiler.js#virtual:normalized:round1View on unpkg

dist/node-runtime/chunk-ES6PBSIE.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-ES6PBSIE.jsView on unpkg

dist/builtin-extensions/pi-intercom/broker/spawn.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-intercom/broker/spawn.jsView on unpkg

dist/node-runtime/chunk-Q4Q6D4IY.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-Q4Q6D4IY.jsView on unpkg

dist/utils/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/node-runtime/chunk-UNUZICC4.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-UNUZICC4.jsView on unpkg

dist/node-runtime/chunk-XTHQ7XR7.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-XTHQ7XR7.jsView on unpkg

dist/node-runtime/brave-2AFFAXNN.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/brave-2AFFAXNN.jsView on unpkg

dist/node-runtime/chunk-2SWW7KMW.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-2SWW7KMW.jsView on unpkg

dist/node-runtime/chunk-3WFAEVKS.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-3WFAEVKS.jsView on unpkg

dist/node-runtime/chunk-Q5ZU2VRT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-Q5ZU2VRT.jsView on unpkg

dist/node-runtime/exa-6VBZNPGE.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/exa-6VBZNPGE.jsView on unpkg

Source & flagged code

25 flagged

package.jsonView file

Lines 15-55json

15 "exports": {

16 ".": {

17 "types": "./dist/index.d.ts",

18 "import": "./dist/node-runtime/index.js"

19 },

20 "./rpc-entry": {

21 "import": "./dist/rpc.js"

22 }

23 },

24 "files": [

25 "dist",

26 "docs",

27 "native/computer-use/LICENSE.md",

28 "scripts/install-browser.mjs",

29 "examples",

30 "CHANGELOG.md",

31 "npm-shrinkwrap.json",

32 "install-lock"

33 ],

34 "scripts": {

35 "postinstall": "node scripts/install-browser.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

36 "clean": "shx rm -rf dist",

40 "copy-binary-assets": "shx cp package.json dist/ && shx cp README.md dist/ && shx cp CHANGELOG.md dist/ &&

41 "test": "vitest --run",

42 "shrinkwrap": "node ../../scripts/generate-coding-agent-shrinkwrap.mjs"

43 },

44 "dependencies": {

45 "@ashx-j/lunr-agent": "^0.2.28",

46 "@ashx-j/lunr-ai": "^0.2.28",

47 "@ashx-j/lunr-tui": "^0.2.28",

48 "@modelcontextprotocol/ext-apps": "1.7.4",

49 "@modelcontextprotocol/sdk": "1.30.0",

50 "@mozilla/readability": "0.6.0",

51 "@silvia-odwyer/photon-node": "0.3.4",

52 "@sinclair/typebox": "npm:typebox@1.1.38",

53 "chalk": "5.6.2",

54 "cross-spawn": "7.0.6",

55 "croner": "10.0.1",

Long lines were clipped for display.

dist/node-runtime/chunk-2VIW3IMF.jsView file

20396patternName = generic_password severity = medium line = 20396

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/node-runtime/chunk-2VIW3IMF.jsView on unpkg · L20396

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

Lines 974-1014javascript

974 ...childReports.flatMap((report) => report.residualRisks ?? []),

975 ...blockers.map((result) => `${result.agent}: ${

dist/node-runtime/chunk-VSUEAI7O.jsView file

Lines 2234-2274javascript

2234 // TODO can its length be used as dataLevel if nil is removed?

2235 dataLevel: 0,

2236 dataTypes: [],

2237 definedProperties: /* @__PURE__ */ new Set(),

2238 topSchemaRef

dist/modes/interactive/theme/theme.jsView file

Lines 1-31javascript

1import * as fs from "node:fs";

2import { createRequire } from "node:module";

3import * as path from "node:path";

dist/core/rollback.jsView file

Lines 7-47javascript

7 * unlike /undo and /edit, which stay in the same session file).

8 *

9 * Capture modes (setting `rollbackCapture`):

10 * - copies: snapshot pre

dist/node-runtime/chunk-EBLAZVSA.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/node-runtime/chunk-EBLAZVSA.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.jsView file

Lines 1-22javascript

1var createDoomModule = (() => {

2 var _scriptName = typeof document != 'undefined' ? document.currentScript?.src : undefined;

3 if

dist/node-runtime/pi-prompt-template-model-FTGELLS5.jsView file

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/node-runtime/pi-prompt-template-model-FTGELLS5.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/tree-sitter/pattern-compiler.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 13

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/tree-sitter/pattern-compiler.js#virtual:normalized:round1View on unpkg

dist/node-runtime/chunk-ES6PBSIE.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-ES6PBSIE.jsView on unpkg

dist/builtin-extensions/pi-intercom/broker/spawn.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-intercom/broker/spawn.jsView on unpkg

dist/node-runtime/chunk-Q4Q6D4IY.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-Q4Q6D4IY.jsView on unpkg

dist/utils/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/node-runtime/chunk-UNUZICC4.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-UNUZICC4.jsView on unpkg

dist/node-runtime/chunk-XTHQ7XR7.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-XTHQ7XR7.jsView on unpkg

dist/node-runtime/brave-2AFFAXNN.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/brave-2AFFAXNN.jsView on unpkg

dist/node-runtime/chunk-2SWW7KMW.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-2SWW7KMW.jsView on unpkg

dist/node-runtime/chunk-3WFAEVKS.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-3WFAEVKS.jsView on unpkg

dist/node-runtime/chunk-Q5ZU2VRT.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/chunk-Q5ZU2VRT.jsView on unpkg

dist/node-runtime/exa-6VBZNPGE.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/node-runtime/exa-6VBZNPGE.jsView on unpkg

@ashx-j/lunr@0.2.28

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code