@aui.io/apollo@0.1.42: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@aui.io/apollo@0.1.42: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

27"scripts": { "check-release-tag": "node ./scripts/check-release-tag.mjs", "postinstall": "node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs", "prepack": "node ./scripts/materialize-bundle.mjs", "postpack": "node ./scripts/clean-bundle.mjs" }

Medium

Suspicious Lifecycle Evidence

The package automatically runs two postinstall scripts.

package.jsonView on unpkg · L27

bin/apollo.jsView file

10L11: const require = createRequire(import.meta.url); L12: const cliBin = require.resolve("@aui.io/apollo-cli/bin/apollo.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/apollo.jsView on unpkg · L10

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView file

•path = node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasm kind = wasm_module sizeBytes = 691726 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView on unpkg

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View on unpkg

node_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aui.io/apollo@0.1.31 matchedIdentity = npm:QGF1aS5pby9hcG9sbG8:0.1.31 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.jsView on unpkg

Source & flagged code

7 flagged

package.jsonView file

Lines 7-49json

7 "node": ">=20"

8 },

9 "bin": {

10 "apollo": "./bin/apollo.js"

11 },

12 "files": [

13 "bin",

14 "scripts/setup-shell.mjs",

15 "scripts/ensure-opentui.mjs"

16 ],

17 "repository": {

18 "type": "git",

19 "url": "git+ssh://git@bitbucket.org/getstuff/runtime-v2.git",

20 "directory": "console/apollo"

21 },

22 "homepage": "https://bitbucket.org/getstuff/runtime-v2/src/main/console/apollo/",

23 "publishConfig": {

24 "access": "public",

25 "registry": "https://registry.npmjs.org/"

26 },

27 "scripts": {

28 "check-release-tag": "node ./scripts/check-release-tag.mjs",

29 "postinstall": "node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "prepack": "node ./scripts/materialize-bundle.mjs",

31 "postpack": "node ./scripts/clean-bundle.mjs"

32 },

Medium

Suspicious Lifecycle Evidence

The package automatically runs two postinstall scripts.

package.jsonView on unpkg · L27

33 "dependencies": {

34 "@aui.io/apollo-core": "0.1.42",

35 "@aui.io/apollo-cli": "0.1.42",

36 "@aui.io/apollo-tui": "0.1.42",

37 "picocolors": "^1.1.1",

38 "yaml": "^2.9.0",

39 "commander": "^14.0.3",

40 "@opentui/core": "^0.4.5",

41 "@opentui/react": "^0.4.5",

42 "diff": "8.0.2",

43 "react": "^19.1.0",

44 "web-tree-sitter": "0.25.10"

45 },

46 "bundleDependencies": [

47 "@aui.io/apollo-core",

48 "@aui.io/apollo-cli",

49 "@aui.io/apollo-tui"

bin/apollo.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2

3/**

4 * Human-facing Apollo entry (@aui.io/apollo).

5 * Depends on both apollo-cli and apollo-tui, then delegates to the CLI dispatcher

6 * so bare TTY opens the TUI and every subcommand stays Commander.

7 */

8import { createRequire } from "node:module";

9import { pathToFileURL } from

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView file

•path = node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasm kind = wasm_module sizeBytes = 691726 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView on unpkg

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View on unpkg

node_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @aui.io/apollo@0.1.31 matchedIdentity = npm:QGF1aS5pby9hcG9sbG8:0.1.31 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

node_modules/@aui.io/apollo-cli/node_modules/commander/lib/command.jsView on unpkg