@ashx-j/lunr@0.2.12: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@ashx-j/lunr@0.2.12: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

8 flagged · loading source

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/core/extensions/loader.jsView file

68} L69: const require = createRequire(import.meta.url); L70: /**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/extensions/loader.jsView on unpkg · L68

dist/core/rollback.jsView file

27*/ L28: import { spawnSync } from "node:child_process"; L29: import { createHash } from "node:crypto"; ... L33: import { CONFIG_DIR_NAME, getAgentDir } from "../config.js"; L34: const ROLLBACK_BASE = join(homedir(), ".lunr", "rollback"); L35: const contexts = new Map(); ... L217: }); L218: if (!headSrc.error && headSrc.status === 0 && headSrc.stdout) { L219: turn.files.set(sourceAbs, { ... L322: try { L323: const parsed = JSON.parse(readFileSync(path, "utf-8")); L324: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/rollback.jsView on unpkg · L27

dist/modes/interactive/interactive-mode.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. [redacted]-mode.js: const ANTHROPIC_SUBSCRIPTION_AUTH_WARNING = "Anthropic subscription auth is active. Third-party harness usage draws from extra usage and is billed per token, not your Claude plan l... const ANTHROPIC_TOS_DISCLAIMER = "Connecting an Anthropic subscription (Claude Pro/Max) account to lunR may violate Anthropic's Terms of Service (https://www.anthropic.com/legal/co... const npmMatch = fullPath.match(/node_modules\/(@?[^/]+(?:\/[^/]+)?)\/(.*)/); this.defaultEditor.onAction("app.message.followUp", () => this.handleFollowUp()); fs.writeFileSync(filePath, Buffer.from(image.bytes)); // lunr: /auth is an alias of /login; the provider arg follows

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/modes/interactive/interactive-mode.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-subagents/src/runs/shared/child-protocol.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-subagents/src/runs/shared/child-protocol.jsView on unpkg

dist/builtin-extensions/pi-subagents/src/runs/background/async-execution.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ashx-j/lunr@0.2.9 matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.9 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/builtin-extensions/pi-subagents/src/runs/background/async-execution.jsView on unpkg

Source & flagged code

8 flagged

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

46

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir = join(__dirname, "doom", "build");

51 const doomJsPath = join(buildDir, "doom.js");

52

53 if (!existsSync(doomJsPath)) {

54 throw new Error(`WASM not found at ${doomJsPath}. Run ./doom/build.sh first`);

55 }

56

57 // Read WAD file

58 const wadData = readFileSync(this.wadPath);

59 const wadArray = Array.from(new Uint8Array(wadData));

60

61 // Load WASM module - eval to bypass jiti completely

62 const doomJsCode = readFileSync(doomJsPath, "utf-8");

63 const moduleExports: { exports: unknown } = { exports: {} };

64 const nativeRequire = createRequire(doomJsPath);

65 const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode);

66 moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

67 const createDoomModule = moduleExports.exports as (config: unknown) => Promise<DoomModule>;

68

69 const moduleConfig = {

70 locateFile: (path: string) => {

71 if (path.endsWith(".wasm")) {

72 return join(buildDir, path);

73 }

74 return path;

75 },

76 print: () => {},

77 printErr: () => {},

78 preRun: [

79 (module: DoomModule) => {

80 // Create /doom directory and add WAD

81 module.FS_createPath("/", "doom", true, true);

82 module.FS_createDataFile("/doom", "doom1.wad", wadArray, true, false);

83 },

84 ],

dist/core/extensions/loader.jsView file

Lines 48-88javascript

48 "@sinclair/typebox/compile": _bundledTypeboxCompile,

49 "@sinclair/typebox/value": _bundledTypeboxValue,

50 ...scopedHostKeys("@ashx-j/lunr-agent", "@ashx-j/lunr-agent", _bundledPiAgentCore),

51 ...scopedHostKeys("@ashx-j/lunr-tui", "@ashx-j/lunr-tui", _bundledPiTui),

dist/core/rollback.jsView file

Lines 7-47javascript

7 * unlike /undo and /edit, which stay in the same session file).

8 *

9 * Capture modes (setting `rollbackCapture`):

10 * - copies: snapshot pre

dist/modes/interactive/interactive-mode.jsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. [redacted]-mode.js: const ANTHROPIC_SUBSCRIPTION_AUTH_WARNING = "Anthropic subscription auth is active. Third-party harness usage draws from extra usage and is billed per token, not your Claude plan l... const ANTHROPIC_TOS_DISCLAIMER = "Connecting an Anthropic subscription (Claude Pro/Max) account to lunR may violate Anthropic's Terms of Service (https://www.anthropic.com/legal/co... const npmMatch = fullPath.match(/node_modules\/(@?[^/]+(?:\/[^/]+)?)\/(.*)/); this.defaultEditor.onAction("app.message.followUp", () => this.handleFollowUp()); fs.writeFileSync(filePath, Buffer.from(image.bytes)); // lunr: /auth is an alias of /login; the provider arg follows

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/modes/interactive/interactive-mode.jsView on unpkg

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-subagents/src/runs/shared/child-protocol.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-subagents/src/runs/shared/child-protocol.jsView on unpkg

dist/builtin-extensions/pi-subagents/src/runs/background/async-execution.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ashx-j/lunr@0.2.9 matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.9 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/builtin-extensions/pi-subagents/src/runs/background/async-execution.jsView on unpkg