@c4a/context-cli: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@c4a/context-cli: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

7L8: import { spawnSync } from "node:child_process"; L9: import { existsSync, realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L7

42"Claude plugin installed without a global context CLI. Install it with:", L43: ` npm install -g @c4a/context-cli@${version}`, L44: ], ... L49: const lookup = process.platform === "win32" L50: ? spawnSync("where", ["context"], { stdio: "ignore" }) L51: : spawnSync("sh", ["-c", "command -v context"], { stdio: "ignore" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L42

parserEntryWorker.jsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31: var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

parserEntryWorker.jsView on unpkg · L29

cli.jsView file

35class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

cli.jsView on unpkg · L35

•Trigger-reachable chain: manifest.main -> cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.jsView on unpkg

35Cross-file remote execution chain: cli.js spawns browser/diagrams.js; helper contains network access plus dynamic code execution. L35: class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

evidence/context-evidence.sourcegraph.wasmView file

•path = evidence/context-evidence.sourcegraph.wasm kind = wasm_module sizeBytes = 1137406 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

evidence/context-evidence.sourcegraph.wasmView on unpkg

browser/diagrams.jsView file

•path = browser/diagrams.js kind = oversized_source_file sizeBytes = 4207607 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

browser/diagrams.jsView on unpkg