@automaton-labs/aib@0.1.2: Malicious npm security report (Block) | LPM Firewall

Loading npm security reports…

@automaton-labs/aib@0.1.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/bin/cli-main.jsView file

1#!/usr/bin/env node L2: 'use strict';var nfe=Object['create'],cW=Object['defineProperty'],rfe=Object['getOwnPropertyDescriptor'],ife=Object['getOwnPropertyNames'],ofe=Object['getPrototypeOf'],sfe=Object['...

High

Child Process

Package source references child process execution.

dist/bin/cli-main.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/cli-main.jsView on unpkg

dist/inspect/standalone-inspect-worker.jsView file

1'use strict';var Tl=Object['create'],vs=Object['defineProperty'],Dl=Object['getOwnPropertyDescriptor'],Ml=Object['getOwnPropertyNames'],vl=Object['getPrototypeOf'],Rl=Object['proto...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/inspect/standalone-inspect-worker.jsView on unpkg · L1

dist/workers/control-plane/aib-control-plane-worker.cjsView file

65L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(r===a[0]){i(a);continue}if(e.external){let u=e.exter... L67: `,"utf8"));let i=wm(e);return{...t,workspaceId:i.workspaceId,workspaceRoot:i.workspaceRoot}}function cy(){return Du.default.join(A(),"control-plane","identity.json")}function uy(e,...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/workers/control-plane/aib-control-plane-worker.cjsView on unpkg · L65

63L64: `)}h.write("payload.value = newResult;"),h.write("return payload;");let D=h.compile();return(w,x)=>D(p,w,x)},i,a=Fe,s=!Be.jitless,u=s&&Di.value,l=r.catchall,f;e._zod.parse=(p,h)=>{... L65: L66: Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let a of e.seen.entries()){let s=a[1];if(r===a[0]){i(a);continue}if(e.external){let u=e.exter... L67: `,"utf8"));let i=wm(e);return{...t,workspaceId:i.workspaceId,workspaceRoot:i.workspaceRoot}}function cy(){return Du.default.join(A(),"control-plane","identity.json")}function uy(e,...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/workers/control-plane/aib-control-plane-worker.cjsView on unpkg · L63

dist/mutation/semantic-rename-config-worker-child.jsView file

1'use strict';function _aib_a23763b7_0x3079(){const _0x522783=['rw5WtLC','C2vTyw50Awnszw5HBwvdB25MAwC','ChjVAMvJDfjLzMvYzw5Jzxm','Aw52ywXPza','[redacted]','...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/mutation/semantic-rename-config-worker-child.jsView on unpkg · L1

runtimes/tools/rg/linux-arm64/rgView file

•path = runtimes/tools/rg/linux-arm64/rg kind = native_binary sizeBytes = 4543848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtimes/tools/rg/linux-arm64/rgView on unpkg

Source & flagged code

9 flagged

package.jsonView file

Lines 6-39json

6 "access": "public"

7 },

8 "bin": {

9 "aib": "dist/bin/aib.js"

10 },

11 "files": [

12 "dist",

13 "config",

14 "scripts/install-windows-launcher.cjs",

15 "scripts/postinstall.cjs",

16 "scripts/provision-runtime.cjs",

17 "runtimes/tools",

18 "README.md",

19 "package.json"

20 ],

21 "scripts": {

22 "build": "npm --silent --prefix ../tooling run build && tsc -p . && node scripts/copy-help-assets.cjs && node ../tooling/dist/cli.js packaging copy-control-plane-worker",

23 "build:package": "npm --silent --prefix ../tooling run build && node ../tooling/dist/cli.js packaging clean-paths dist && tsc -p tsconfig.package.json && node ../tooling/dist/cli.js packaging validate-package-artifacts && node scripts/copy-help-assets.cjs && node ../tooling/dist/cli.js packaging copy-control-plane-worker --minify && node ../tooling/dist/cli.js packaging minify-js dist",

24 "build:package:candidate": "npm --silent --prefix ../tooling run build && node ../tooling/dist/cli.js packaging build-package-candidate",

25 "typecheck": "tsc -p . --noEmit",

26 "postinstall": "node scripts/postinstall.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "sync:tool-runtimes": "npm --silent --prefix ../tooling run build && node ../tooling/dist/cli.js runtime sync-tool-runtimes",

28 "prepack": "node scripts/reject-direct-package-pack.cjs",

29 "pack:local": "npm --silent --prefix ../tooling run build && node ../tooling/dist/cli.js packaging build-package-candidate --tarball-out-dir .tmp"

30 },

31 "dependencies": {

32 "typescript": "^6.0.3",

33 "zod": "^4.1.12"

34 },

35 "engines": {

36 "node": ">=20"

37 }

38}

39

dist/bin/cli-main.jsView file

1#!/usr/bin/env node L2: 'use strict';var nfe=Object['create'],cW=Object['defineProperty'],rfe=Object['getOwnPropertyDescriptor'],ife=Object['getOwnPropertyNames'],ofe=Object['getPrototypeOf'],sfe=Object['...

High

Child Process

Package source references child process execution.

dist/bin/cli-main.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/bin/cli-main.jsView on unpkg

dist/inspect/standalone-inspect-worker.jsView file

Lines 1-1javascript

1'use strict';var Tl=Object['create'],vs=Object['defineProperty'],Dl=Object['getOwnPropertyDescriptor'],Ml=Object['getOwnPropertyNames'],vl=Object['getPrototypeOf'],Rl=Object['prototype'

dist/workers/control-plane/aib-control-plane-worker.cjsView file

Lines 43-85javascript

43 ...iss,

44 path: iss.path ? [${I}, ...iss.path] : [${I}]

45 })));

46 }

47 if (!${x}_present &&

dist/mutation/semantic-rename-config-worker-child.jsView file

Lines 1-1javascript

1'use strict';function _aib_a23763b7_0x3079(){const _0x522783=['rw5WtLC','C2vTyw50Awnszw5HBwvdB25MAwC','ChjVAMvJDfjLzMvYzw5Jzxm','Aw52ywXPza','C2vTyw50Awnszw5HBwvdB25MAwDszxn1Bhq','D2LUmZi','y3jLyxrLsgfZAa','AuLouMS'

runtimes/tools/rg/linux-arm64/rgView file

•path = runtimes/tools/rg/linux-arm64/rg kind = native_binary sizeBytes = 4543848 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

runtimes/tools/rg/linux-arm64/rgView on unpkg