@ashx-j/lunr@0.2.4: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@ashx-j/lunr@0.2.4: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged · loading source

dist/core/exec.jsView file

3*/ L4: import { spawn } from "node:child_process"; L5: import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

946env: { ...process.env, ...(command.env ?? {}) }, L947: shell: true, L948: stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView on unpkg · L946

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/utils/photon.jsView file

17import { fileURLToPath } from "url"; L18: const require = createRequire(import.meta.url); L19: const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/photon.jsView on unpkg · L17

dist/core/rollback.jsView file

27*/ L28: import { spawnSync } from "node:child_process"; L29: import { createHash } from "node:crypto"; ... L33: import { CONFIG_DIR_NAME, getAgentDir } from "../config.js"; L34: const ROLLBACK_BASE = join(homedir(), ".lunr", "rollback"); L35: const contexts = new Map(); ... L217: }); L218: if (!headSrc.error && headSrc.status === 0 && headSrc.stdout) { L219: turn.files.set(sourceAbs, { ... L322: try { L323: const parsed = JSON.parse(readFileSync(path, "utf-8")); L324: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/rollback.jsView on unpkg · L27

examples/extensions/doom-overlay/doom/build/doom.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});var ENVIRONM... L9:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

examples/extensions/doom-overlay/doom/build/doom.jsView on unpkg · L7

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View on unpkg

dist/utils/shell.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/shell.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = [redacted]-editor.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/core/resolve-config-value.jsView file

•matchType = normalized_sha256 matchedPackage = @phi-code-admin/phi-code@0.99.0 matchedPath = dist/core/resolve-config-value.js matchedIdentity = npm:[redacted]:0.99.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/resolve-config-value.jsView on unpkg

dist/utils/tools-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/tools-manager.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/tools-manager.jsView on unpkg

dist/modes/rpc/rpc-client.jsView file

•matchType = token_shingles matchedPackage = @phi-code-admin/phi-code@0.99.0 matchedPath = dist/modes/rpc/rpc-client.js matchedIdentity = npm:[redacted]:0.99.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-client.jsView on unpkg

dist/modes/rpc/rpc-mode.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/modes/rpc/rpc-mode.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-mode.jsView on unpkg

dist/utils/clipboard.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/clipboard.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/clipboard.jsView on unpkg

dist/builtin-extensions/pi-mcp-adapter/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/builtin-extensions/pi-mcp-adapter/utils.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-mcp-adapter/utils.jsView on unpkg

dist/cli/args.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/cli/args.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/args.jsView on unpkg