@axiomantic/vine@0.1.6: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@axiomantic/vine@0.1.6: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

bin/run.jsView file

4const os = require('os'); L5: const { spawnSync, execSync } = require('child_process'); L6: ... L8: const REPO = `axiomantic/${PKG_NAME}`; L9: const VERSION = require('../package.json').version; L10: ... L21: L22: const platform = process.platform; L23: const arch = process.arch; ... L63: const candidates = [ L64: path.join(__dirname, 'binaries', `${PKG_NAME}-${process.platform}-${process.arch}${ext}`), L65: path.join(__dirname, 'binaries', `${PKG_NAME}-${process.platform}-${process.arch === 'x64' ? 'amd64' : process.arch}${ext}`),

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L4

144const res = spawnSync(binPath, process.argv.slice(2), { stdio: 'inherit', env: process.env }); if (res.error)

Medium

Ai Review Evidence

package.json routes the CLI and main entrypoint to bin/run.js; the launcher executes a native binary with caller arguments and environment.

bin/run.jsView on unpkg · L144

bin/binaries/vine-darwin-x64View file

•path = bin/binaries/vine-darwin-x64 kind = native_binary sizeBytes = 371200 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/binaries/vine-darwin-x64View on unpkg

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 4826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

83# Claude Code if [ -d "$HOME/.claude/rules" ]; then echo "$target_content" > "$HOME/.claude/rules/braid.md" echo "Installed Braid rule to ~/.claude/rules/braid.md" fi # Ope

Medium

Ai Review Evidence

scripts/install.sh overwrites Braid rules in existing Claude, OpenCode, and Antigravity configuration directories.

scripts/install.shView on unpkg · L83

90# OpenCode if [ -d "$HOME/.config/opencode/instructions" ]; then echo "$target_content" > "$HOME/.[redacted].md" echo "Installed Braid instruction to ~/.config/opencode/instr

Medium

Ai Review Evidence

scripts/install.sh overwrites Braid rules in existing Claude, OpenCode, and Antigravity configuration directories.

scripts/install.shView on unpkg · L90

package.jsonView file

5"main": "bin/run.js", "bin": { "vine": "bin/run.js" }, "skills": "./skills", "fi

Medium

Ai Review Evidence

package.json routes the CLI and main entrypoint to bin/run.js; the launcher executes a native binary with caller arguments and environment.

package.jsonView on unpkg · L5

Source & flagged code

7 flagged

bin/run.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2const fs = require('fs');

3const path = require('path');

4const os = require('os');

5const { spawnSync, execSync } = require('child_process');

6

7const PKG_NAME = 'vine';

8const REPO = `axiomantic/${PKG_NAME}`;

9const VERSION = require('../package.json').version;

10

11function isCompatibleBinary(filePath) {

12 try {

13 if (!fs.existsSync(filePath)) return false;

14 const stat = fs.statSync(filePath);

15 if (!stat.isFile() || stat.size < 64) return false;

16

17 const fd = fs.openSync(filePath, 'r');

18 const buf = Buffer.alloc(64);

19 fs.readSync(fd, buf, 0, 64, 0);

20 fs.closeSync(fd);

21

22 const platform = process.platform;

23 const arch = process.arch;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/run.jsView on unpkg · L4

24

Lines 124-155javascript

124 try { fs.chmodSync(cachedBin, 0o755); } catch (_) {}

125 return cachedBin;

126 }

127 } catch (_) {}

128 }

129

130 return null;

131

bin/binaries/vine-darwin-x64View file

•path = bin/binaries/vine-darwin-x64 kind = native_binary sizeBytes = 371200 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/binaries/vine-darwin-x64View on unpkg

scripts/install.shView file

Lines 63-110text

633. Repositories without submodules: `git worktree add "$STRAND_DIR" -b "<branch>"`.

644. Stat cache warmup: `git -C "$STRAND_DIR" update-index --refresh >/dev/null 2>&1 || true`.

65

66### Step 3: APFS CoW Vendoring Fast-Path

67Clone pre-built dependency caches from canonical repository:

68```bash

69CANONICAL_REPO="$HOME/Development/<project>"

70VENDORED_DIRS=("deps" "nimbledeps" "vendor" "node_modules" ".zig-cache")

71for vdir in "${VENDORED_DIRS[@]}"; do

72 if [ -d "$CANONICAL_REPO/$vdir" ] && [ ! -d "$STRAND_DIR/$vdir" ]; then

73 cp -c -R "$CANONICAL_REPO/$vdir" "$STRAND_DIR/$vdir"

74

package.jsonView file

Lines 1-25json

1{

2 "name": "@axiomantic/vine",

3 "version": "0.1.6",

4 "description": "Sub-Second APFS Copy-on-Write Workspaces & Zero-Mirage Git Weaving Engine",

5 "main": "bin/run.js",

6