@aui.io/apollo@0.1.30: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@aui.io/apollo@0.1.30: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/apollo.jsView file

10L11: const require = createRequire(import.meta.url); L12: const cliBin = require.resolve("@aui.io/apollo-cli/bin/apollo.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/apollo.jsView on unpkg · L10

scripts/setup-shell.mjsView file

17const MARKER = "apollo shell-init"; const LINE = '\n# apollo shell integration (auto-cd on workspace create/use); remove to disable\n' + 'command -v apollo >/dev/null 2>&1 && eval "$(apollo shell-init)"\n'; try { if (process.env.CI || process.env.APOLLO_NO_SHELL_SETUP === "1") process.exit(0);

Medium

Suspicious Lifecycle Evidence

postinstall automatically appends an eval-based shell hook to user shell RC files.

scripts/setup-shell.mjsView on unpkg · L17

26// Every rc a zsh/bash session might read: login shells and interactive ones. const candidates = [".zshrc", ".bashrc", ".bash_profile"].map((name) => path.join(home, name), ); const loginRc = loginShell === "zsh" ? path.join(home, ".zshrc") : loginShell === "bash" ? path.join(home, process.platform === "darwin" ? ".bash_profile" : ".bashrc") : undefined; const targets = candidates.filter( (candidate) => existsSync(candidate) || candidate === loginRc, );

Medium

Ai Review Evidence

The hook targets every existing zsh/bash RC file and can create the login shell RC.

scripts/setup-shell.mjsView on unpkg · L26

scripts/ensure-opentui.mjsView file

31if (existsSync(opentuiRoot)) { rmSync(opentuiRoot, { recursive: true, force: true }); } const apollo = JSON.parse(readFileSync(join(root, "package.json"), "utf8")); const specs = ["@opentui/core", "@opentui/react"] .map((name) => { const range = apollo.dependencies?.[name]; return range ? `${name}@${range}` : undefined; }) .filter((value) => value !== undefined); if (specs.length === 0) process.exit(0); console.log(`apollo: repairing OpenTUI install (${specs.join(", ")})...`); const result = spawnSync( "npm", ["install", ...specs, "--omit=de

Medium

Suspicious Lifecycle Evidence

Postinstall can delete its package-local @opentui directory and invoke npm install to repair it.

scripts/ensure-opentui.mjsView on unpkg · L31

Source & flagged code

6 flagged

package.jsonView file

Lines 9-49json

9 "bin": {

10 "apollo": "./bin/apollo.js"

11 },

12 "files": [

13 "bin",

14 "scripts/setup-shell.mjs",

15 "scripts/ensure-opentui.mjs"

16 ],

17 "repository": {

18 "type": "git",

19 "url": "git+ssh://git@bitbucket.org/getstuff/runtime-v2.git",

20 "directory": "console/apollo"

21 },

22 "homepage": "https://bitbucket.org/getstuff/runtime-v2/src/main/console/apollo/",

23 "publishConfig": {

24 "access": "public",

25 "registry": "https://registry.npmjs.org/"

26 },

27 "scripts": {

28 "check-release-tag": "node ./scripts/check-release-tag.mjs",

29 "postinstall": "node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "prepack": "node ./scripts/materialize-bundle.mjs",

31 "postpack": "node ./scripts/clean-bundle.mjs"

32 },

33 "dependencies": {

34 "@aui.io/apollo-core": "0.1.30",

35 "@aui.io/apollo-cli": "0.1.30",

36 "@aui.io/apollo-tui": "0.1.30",

37 "picocolors": "^1.1.1",

38 "yaml": "^2.9.0",

39 "commander": "^14.0.3",

40 "@opentui/core": "^0.4.5",

41 "@opentui/react": "^0.4.5",

42 "diff": "8.0.2",

43 "react": "^19.1.0",

44 "web-tree-sitter": "0.25.10"

45 },

46 "bundleDependencies": [

47 "@aui.io/apollo-core",

48 "@aui.io/apollo-cli",

49 "@aui.io/apollo-tui"

bin/apollo.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2

3/**

4 * Human-facing Apollo entry (@aui.io/apollo).

5 * Depends on both apollo-cli and apollo-tui, then delegates to the CLI dispatcher

6 * so bare TTY opens the TUI and every subcommand stays Commander.

7 */

8import { createRequire } from "node:module";

9import { pathToFileURL } from

scripts/setup-shell.mjsView file

Lines 1-46javascript

1#!/usr/bin/env node

2/**

3 * @aui.io/apollo postinstall: wire up shell integration (auto-cd after

4 * `apollo workspace create/use`) by appending one guarded eval line to the

5 * user's shell rc files. Idempotent; never fails the install.

6 *

7 * Users often run a shell other than their login shell (e.g. bash terminals

8 * on a zsh login), so this targets every rc that exists — and creates the

9 * login shell's rc if missing. zsh/bash only; anything else gets a hint.

10 * Skips: CI, APOLLO_NO_SHELL_SETUP=1. Manual: eval "$(apollo shell-init)".

scripts/ensure-opentui.mjsView file

Lines 11-51javascript

11

12const root = join(dirname(fileURLToPath(import.meta.url)), "..");

13const opentuiRoot = join(root,