@aui.io/apollo@0.1.43: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@aui.io/apollo@0.1.43: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

27"scripts": { "check-release-tag": "node ./scripts/check-release-tag.mjs", "postinstall": "node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs", "prepack": "node ./scripts/materialize-bundle.mjs", "postpack": "node ./scripts/clean-bundle.mjs" }

Medium

Suspicious Lifecycle Evidence

The install hook automatically runs both repair and shell-setup scripts.

package.jsonView on unpkg · L27

bin/apollo.jsView file

10L11: const require = createRequire(import.meta.url); L12: const cliBin = require.resolve("@aui.io/apollo-cli/bin/apollo.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/apollo.jsView on unpkg · L10

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView file

•path = node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasm kind = wasm_module sizeBytes = 691726 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView on unpkg

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View on unpkg

scripts/setup-shell.mjsView file

26// Every rc a zsh/bash session might read: login shells and interactive ones. const candidates = [".zshrc", ".bashrc", ".bash_profile"].map((name) => path.join(home, name), ); const loginRc = loginShell === "zsh" ? path.join(home, ".zshrc") : loginShell === "bash" ? path.join(home, process.platform === "darwin" ? ".bash_profile" : ".bashrc") : undefined; const targets = candidates.filter( (candidate) => existsSync(candidate) || candidate === loginRc, );

Medium

Ai Review Evidence

The shell setup selects existing user shell startup files and appends to them during installation.

scripts/setup-shell.mjsView on unpkg · L26

Source & flagged code

7 flagged

package.jsonView file

Lines 7-49json

7 "node": ">=20"

8 },

9 "bin": {

10 "apollo": "./bin/apollo.js"

11 },

12 "files": [

13 "bin",

14 "scripts/setup-shell.mjs",

15 "scripts/ensure-opentui.mjs"

16 ],

17 "repository": {

18 "type": "git",

19 "url": "git+ssh://git@bitbucket.org/getstuff/runtime-v2.git",

20 "directory": "console/apollo"

21 },

22 "homepage": "https://bitbucket.org/getstuff/runtime-v2/src/main/console/apollo/",

23 "publishConfig": {

24 "access": "public",

25 "registry": "https://registry.npmjs.org/"

26 },

27 "scripts": {

28 "check-release-tag": "node ./scripts/check-release-tag.mjs",

29 "postinstall": "node ./scripts/ensure-opentui.mjs && node ./scripts/setup-shell.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L29

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L29

30 "prepack": "node ./scripts/materialize-bundle.mjs",

31 "postpack": "node ./scripts/clean-bundle.mjs"

32 },

Medium

Suspicious Lifecycle Evidence

The install hook automatically runs both repair and shell-setup scripts.

package.jsonView on unpkg · L27

33 "dependencies": {

34 "@aui.io/apollo-core": "0.1.43",

35 "@aui.io/apollo-cli": "0.1.43",

36 "@aui.io/apollo-tui": "0.1.43",

37 "picocolors": "^1.1.1",

38 "yaml": "^2.9.0",

39 "commander": "^14.0.3",

40 "@opentui/core": "^0.4.5",

41 "@opentui/react": "^0.4.5",

42 "diff": "8.0.2",

43 "react": "^19.1.0",

44 "web-tree-sitter": "0.25.10"

45 },

46 "bundleDependencies": [

47 "@aui.io/apollo-core",

48 "@aui.io/apollo-cli",

49 "@aui.io/apollo-tui"

bin/apollo.jsView file

Lines 1-14javascript

1#!/usr/bin/env node

2

3/**

4 * Human-facing Apollo entry (@aui.io/apollo).

5 * Depends on both apollo-cli and apollo-tui, then delegates to the CLI dispatcher

6 * so bare TTY opens the TUI and every subcommand stays Commander.

7 */

8import { createRequire } from "node:module";

9import { pathToFileURL } from

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView file

•path = node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasm kind = wasm_module sizeBytes = 691726 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

node_modules/@aui.io/apollo-tui/node_modules/@opentui/core/assets/zig/tree-sitter-zig.wasmView on unpkg

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 11

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

node_modules/@aui.io/apollo-core/node_modules/yaml/dist/parse/lexer.js#virtual:normalized:round1View on unpkg

scripts/setup-shell.mjsView file

Lines 6-46javascript

6 *

7 * Users often run a shell other than their login shell (e.g. bash terminals

8 * on a zsh login), so this targets every rc that exists — and creates the

9 * login shell's rc if missing. zsh/bash only; anything else gets a hint.

10 * Skips