@axiomantic/garden@0.2.0: Clean npm security report (Allow) | LPM Firewall

Loading npm security reports…

@axiomantic/garden@0.2.0: Clean npm security report (Allow) | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/run.jsView file

4const os = require('os'); L5: const { spawnSync, execSync } = require('child_process'); L6: ... L8: const REPO = `axiomantic/${PKG_NAME}`; L9: const VERSION = require('../package.json').version; L10: ... L21: L22: const platform = process.platform; L23: const arch = process.arch; ... L63: const candidates = [ L64: path.join(__dirname, 'binaries', `${PKG_NAME}-${process.platform}-${process.arch}${ext}`), L65: path.join(__dirname, 'binaries', `${PKG_NAME}-${process.platform}-${process.arch === 'x64' ? 'amd64' : process.arch}${ext}`),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L4

86if (isCompatibleBinary(cachedBin)) { return cachedBin; } // 3. Auto-download from GitHub releases const assetExt = process.platform === 'win32' ? '.zip' : '.tar.gz'; const assetName = `${PKG_NAME}-${platform}-${arch}${assetExt}`; const downloadUrl = `https://github.com/${REPO}/releases/download/v${VERSION}/${assetName}`; try { fs.mkdirSync(cacheBinDir, { recursive: true }); process.stderr.write(`[@

Low

Ai Review Evidence

bin/run.js selects a release binary from the package’s GitHub repository, then runs it with the user’s arguments and environment when the CLI is invoked.

bin/run.jsView on unpkg · L86

146env: process.env }); if (res.error) { console.error(`Failed to execute binary: ${res.error.message}`); process.exit(1); } process.exit(res.status !== null ? res.status : (res.signal ? 1 : 0));

Low

Ai Review Evidence

bin/run.js selects a release binary from the package’s GitHub repository, then runs it with the user’s arguments and environment when the CLI is invoked.

bin/run.jsView on unpkg · L146

bin/binaries/garden-linux-x64View file

•path = bin/binaries/garden-linux-x64 kind = native_binary sizeBytes = 314664 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/binaries/garden-linux-x64View on unpkg

scripts/launch_tmux_swarm.shView file

•path = scripts/launch_tmux_swarm.sh kind = build_helper sizeBytes = 6927 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/launch_tmux_swarm.shView on unpkg

package.jsonView file

5"main": "bin/run.js", "bin": { "garden": "bin/run.js" }, "skills": "./skills", "files": [ "bin/run.js", "bin

Low

Suspicious Lifecycle Evidence

package.json routes both the package entrypoint and the garden command to bin/run.js; no lifecycle hooks are declared.

package.jsonView on unpkg · L5

2"name": "@axiomantic/garden", "version": "0.2.0", "description": "Multi-Agent Swarm Orchestration, Empirical Dialectics & Ceremonies on top of Rhizo & Vine", "mai

Low

Suspicious Lifecycle Evidence

package.json routes both the package entrypoint and the garden command to bin/run.js; no lifecycle hooks are declared.

package.jsonView on unpkg · L2

Source & flagged code

7 flagged

bin/run.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const os = require('os');

5const { spawnSync, execSync } = require('child_process');

6

7const PKG_NAME = 'garden';

8const REPO = `axiomantic/${PKG_NAME}`;

9const VERSION = require('../package.json').version;

10

11function isCompatibleBinary(filePath) {

12 try {

13 if (!fs.existsSync(filePath)) return false;

14 const stat = fs.statSync(filePath);

15 if (!stat.isFile() || stat.size < 64) return false;

16

17 const fd = fs.openSync(filePath, 'r');

18 const buf = Buffer.alloc(64);

19 fs.readSync(fd, buf, 0, 64, 0);

20 fs.closeSync(fd);

21

22 const platform = process.platform;

23 const arch = process.arch;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L4

24

Lines 66-106javascript

66 path.join(__dirname, `${PKG_NAME}-${process.platform}-${process.arch}${ext}`),

67 path.join(__dirname, `${PKG_NAME}${ext}`),

68 path.join(__dirname, '..'

Lines 126-155javascript

126 }

127 } catch (_) {}

128 }

129

130 return null;

131}

132

133const binPath = resolveBinary();

134if (

bin/binaries/garden-linux-x64View file

•path = bin/binaries/garden-linux-x64 kind = native_binary sizeBytes = 314664 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/binaries/garden-linux-x64View on unpkg

scripts/launch_tmux_swarm.shView file

•path = scripts/launch_tmux_swarm.sh kind = build_helper sizeBytes = 6927 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/launch_tmux_swarm.shView on unpkg

package.jsonView file

Lines 1-25json

1{

2 "name": "@axiomantic/garden",

3 "version": "0.2.0",

4 "description": "Multi-Agent Swarm Orchestration, Empirical Dialectics & Ceremonies on top of Rhizo & Vine",

5 "main": "bin/run.js",