@ashx-j/lunr@0.2.8: Suspicious npm security report (Warn)

Loading npm security reports…

@ashx-j/lunr@0.2.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

18 flagged

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

6/**

7 * Execute a shell command and return stdout/stderr/code.

8 * Supports timeout and abort signal.

9 */

10export async function execCommand(command, args, cwd, options) {

11 return new Promise((resolve) => {

12 const proc = spawn(command, args, {

13 cwd,

14 shell: false,

15 stdio: ["ignore", "pipe", "pipe"],

16 });

17 let stdout = "";

18 let stderr = "";

19 let killed = false;

20 let timeoutId;

21 const killProcess = () => {

22 if (!killed) {

23 killed = true;

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

Lines 926-966javascript

926 ...childReports.flatMap((report) => report.residualRisks ?? []),

927 ...blockers.map((result) => `${result.agent}: ${

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath

dist/utils/photon.jsView file

Lines 1-37javascript

1/**

2 * Photon image processing wrapper.

3 *

4 * This module provides a unified interface to @silvia-odwyer/photon-node that works in:

5 * 1. Node.js (development, npm run build)

6 * 2. Bun compiled binaries (standalone distribution)

7 *

8 * The challenge: photon-node's CJS entry uses fs.readFileSync(__dirname + '/photon_rs_bg.wasm')

9 * which bakes the build machine's absolute path into Bun compiled binaries.

10 *

dist/core/rollback.jsView file

Lines 7-47javascript

7 * unlike /undo and /edit, which stay in the same session file).

8 *

9 * Capture modes (setting `rollbackCapture`):

10 * - copies: snapshot pre

examples/extensions/doom-overlay/doom/build/doom.jsView file

Lines 1-22javascript

1var createDoomModule = (() => {

2 var _scriptName = typeof document != 'undefined' ? document.currentScript?.src : undefined;

3 if

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View on unpkg

dist/utils/shell.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/shell.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = [redacted]-editor.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/core/resolve-config-value.jsView file

•matchType = normalized_sha256 matchedPackage = @phi-code-admin/phi-code@0.99.0 matchedPath = dist/core/resolve-config-value.js matchedIdentity = npm:[redacted]:0.99.0 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/resolve-config-value.jsView on unpkg

dist/utils/tools-manager.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/tools-manager.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/tools-manager.jsView on unpkg

dist/modes/rpc/rpc-client.jsView file

•matchType = token_shingles matchedPackage = @phi-code-admin/phi-code@0.99.0 matchedPath = dist/modes/rpc/rpc-client.js matchedIdentity = npm:[redacted]:0.99.0 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-client.jsView on unpkg

dist/modes/rpc/rpc-mode.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/modes/rpc/rpc-mode.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-mode.jsView on unpkg

dist/utils/clipboard.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/utils/clipboard.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/clipboard.jsView on unpkg

dist/builtin-extensions/pi-mcp-adapter/utils.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/builtin-extensions/pi-mcp-adapter/utils.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-mcp-adapter/utils.jsView on unpkg

dist/cli/args.jsView file

•matchType = normalized_sha256 matchedPackage = @ashx-j/lunr@0.2.21 matchedPath = dist/cli/args.js matchedIdentity = npm:QGFzaHgtai9sdW5y:0.2.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/args.jsView on unpkg

Source & flagged code

18 flagged · loading source

dist/core/exec.jsView file

3*/ L4: import { spawn } from "node:child_process"; L5: import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

946env: { ...process.env, ...(command.env ?? {}) }, L947: shell: true, L948: stdio: ["ignore", "pipe", "pipe"],

High

Shell

Package source references shell execution.

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView on unpkg · L946

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/utils/photon.jsView file

17import { fileURLToPath } from "url"; L18: const require = createRequire(import.meta.url); L19: const fs = require("fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/utils/photon.jsView on unpkg · L17

dist/core/rollback.jsView file

27*/ L28: import { spawnSync } from "node:child_process"; L29: import { createHash } from "node:crypto"; ... L33: import { CONFIG_DIR_NAME, getAgentDir } from "../config.js"; L34: const ROLLBACK_BASE = join(homedir(), ".lunr", "rollback"); L35: const contexts = new Map(); ... L217: }); L218: if (!headSrc.error && headSrc.status === 0 && headSrc.stdout) { L219: turn.files.set(sourceAbs, { ... L322: try { L323: const parsed = JSON.parse(readFileSync(path, "utf-8")); L324: if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/core/rollback.jsView on unpkg · L27

examples/extensions/doom-overlay/doom/build/doom.jsView file

7L8: var Module=moduleArg;var readyPromiseResolve,readyPromiseReject;var readyPromise=new Promise((resolve,reject)=>{readyPromiseResolve=resolve;readyPromiseReject=reject});var ENVIRONM... L9:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

examples/extensions/doom-overlay/doom/build/doom.jsView on unpkg · L7

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View on unpkg

dist/utils/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/core/resolve-config-value.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/resolve-config-value.jsView on unpkg

dist/utils/tools-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/tools-manager.jsView on unpkg

dist/modes/rpc/rpc-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-client.jsView on unpkg

dist/modes/rpc/rpc-mode.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-mode.jsView on unpkg

dist/utils/clipboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/clipboard.jsView on unpkg

dist/builtin-extensions/pi-mcp-adapter/utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-mcp-adapter/utils.jsView on unpkg

dist/cli/args.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/args.jsView on unpkg

Source & flagged code

18 flagged

dist/core/exec.jsView file

Lines 1-23javascript

1/**

2 * Shared command execution utilities for extensions and custom tools.

3 */

4import { spawn } from "node:child_process";

5import { waitForChildProcess } from "../utils/child-process.js";

High

Child Process

Package source references child process execution.

dist/core/exec.jsView on unpkg · L3

6/**

7 * Execute a shell command and return stdout/stderr/code.

8 * Supports timeout and abort signal.

9 */

10export async function execCommand(command, args, cwd, options) {

11 return new Promise((resolve) => {

12 const proc = spawn(command, args, {

13 cwd,

14 shell: false,

15 stdio: ["ignore", "pipe", "pipe"],

16 });

17 let stdout = "";

18 let stderr = "";

19 let killed = false;

20 let timeoutId;

21 const killProcess = () => {

22 if (!killed) {

23 killed = true;

dist/builtin-extensions/pi-subagents/src/runs/shared/acceptance.jsView file

Lines 926-966javascript

926 ...childReports.flatMap((report) => report.residualRisks ?? []),

927 ...blockers.map((result) => `${result.agent}: ${

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath

dist/utils/photon.jsView file

Lines 1-37javascript

1/**

2 * Photon image processing wrapper.

3 *

4 * This module provides a unified interface to @silvia-odwyer/photon-node that works in:

5 * 1. Node.js (development, npm run build)

6 * 2. Bun compiled binaries (standalone distribution)

7 *

8 * The challenge: photon-node's CJS entry uses fs.readFileSync(__dirname + '/photon_rs_bg.wasm')

9 * which bakes the build machine's absolute path into Bun compiled binaries.

10 *

dist/core/rollback.jsView file

Lines 7-47javascript

7 * unlike /undo and /edit, which stay in the same session file).

8 *

9 * Capture modes (setting `rollbackCapture`):

10 * - copies: snapshot pre

examples/extensions/doom-overlay/doom/build/doom.jsView file

Lines 1-22javascript

1var createDoomModule = (() => {

2 var _scriptName = typeof document != 'undefined' ? document.currentScript?.src : undefined;

3 if

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/builtin-extensions/pi-lsp-extension/src/index.js#virtual:normalized:round1View on unpkg

dist/utils/shell.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/shell.jsView on unpkg

dist/modes/interactive/components/extension-editor.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/interactive/components/extension-editor.jsView on unpkg

dist/core/resolve-config-value.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/resolve-config-value.jsView on unpkg

dist/utils/tools-manager.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/tools-manager.jsView on unpkg

dist/modes/rpc/rpc-client.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-client.jsView on unpkg

dist/modes/rpc/rpc-mode.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/modes/rpc/rpc-mode.jsView on unpkg

dist/utils/clipboard.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/clipboard.jsView on unpkg

dist/builtin-extensions/pi-mcp-adapter/utils.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/builtin-extensions/pi-mcp-adapter/utils.jsView on unpkg

dist/cli/args.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/args.jsView on unpkg

@ashx-j/lunr@0.2.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code