@c4a/context-cli@0.6.19: Unknown npm security report (Allow)

Loading npm security reports…

@c4a/context-cli@0.6.19: Unknown npm security report (Allow) | LPM Firewall

Source & flagged code

10 flagged

package.jsonView file

Lines 27-50json

27 "@c4a/context": "0.6.19",

28 "commander": "^11.0.0",

29 "fast-xml-parser": "^5.10.1",

30 "handlebars": "^4.7.8",

31 "ink": "^5.0.0",

32 "jiti": "^2.7.0",

33 "mdast-util-to-string": "^4.0.0",

34 "react": "^18.3.1",

35 "remark-gfm": "^4.0.1",

36 "remark-mdx": "^3.1.1",

37 "remark-parse": "^11.0.0",

38 "remark-stringify": "^11.0.0",

39 "sharp": "^0.35.3",

40 "typescript": "^5.5.4",

41 "unified": "^11.0.5",

42 "web-tree-sitter": "^0.20.8",

43 "yaml": "^2.5.1"

44 },

45 "main": "./cli.js",

46 "scripts": {

47 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 }

49}

scripts/postinstall.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2/**

3 * Best-effort global agent plugin refresh after a global context-cli install.

4 * Local project dependencies and CI installs must not mutate user-level agent

5 * configuration. Link development performs the same refresh in cliLink.ts.

6 */

8import { spawnSync } from "node:child_process";

9import { existsSync, realpathSync }

cli.jsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. cli.js: import { mkdir as mkdir4, rename as rename2, rm, writeFile as writeFile3 } from "node:fs/promises"; async function atomicWriteFile(path3, content3) { await writeFile3(tmpPath, content3, "utf8"); await atomicWriteFile(paths.state, `${JSON.stringify(nextState, null, 2)} await atomicWriteFile(packagePath, `${JSON.stringify(parsed, null, 2)} await atomicWriteFile(outputPath, `${JSON.stringify(replay, null, 2)} SENSITIVE_OPTION = /^(--(?:auth|authorization|password|secret|token|otp|cookie|api-key))(?:=|$)/iu; import { mkdir as mkdir7, readFile as readFile9, rm as rm3, writeFile as writeFile4 } from "node:fs/promises";

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli.jsView on unpkg

•path = cli.js kind = oversized_source_file sizeBytes = 4383696 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

cli.jsView on unpkg

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

7L8: import { spawnSync } from "node:child_process"; L9: import { existsSync, realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L7

7Cross-file remote execution chain: scripts/postinstall.mjs spawns cli.js; helper contains network access plus dynamic code execution. L7: L8: import { spawnSync } from "node:child_process"; L9: import { existsSync, realpathSync } from "node:fs"; ... L18: export function looksLikeClaudePluginInstall(env) { L19: const hints = ["CLAUDE_PLUGIN_INSTALL", "CLAUDE_CODE_PLUGIN", "npm[redacted]"]; L20: return hints.some((key) => env[key]?.toLowerCase().includes("claude") === true); ... L64: function log(message) { L65: process.stderr.write(`[context-cli postinstall] ${message}\n`); L66: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

scripts/postinstall.mjsView on unpkg · L7

42"Claude plugin installed without a global context CLI. Install it with:", L43: ` npm install -g @c4a/context-cli@${version}`, L44: ], ... L49: const lookup = process.platform === "win32" L50: ? spawnSync("where", ["context"], { stdio: "ignore" }) L51: : spawnSync("sh", ["-c", "command -v context"], { stdio: "ignore" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L42

cli.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli.jsView on unpkg

•path = cli.js kind = oversized_source_file sizeBytes = 4383696 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

cli.jsView on unpkg

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

Source & flagged code

10 flagged

package.jsonView file

Lines 27-50json

27 "@c4a/context": "0.6.19",

28 "commander": "^11.0.0",

29 "fast-xml-parser": "^5.10.1",

30 "handlebars": "^4.7.8",

31 "ink": "^5.0.0",

32 "jiti": "^2.7.0",

33 "mdast-util-to-string": "^4.0.0",

34 "react": "^18.3.1",

35 "remark-gfm": "^4.0.1",

36 "remark-mdx": "^3.1.1",

37 "remark-parse": "^11.0.0",

38 "remark-stringify": "^11.0.0",

39 "sharp": "^0.35.3",

40 "typescript": "^5.5.4",

41 "unified": "^11.0.5",

42 "web-tree-sitter": "^0.20.8",

43 "yaml": "^2.5.1"

44 },

45 "main": "./cli.js",

46 "scripts": {

47 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L47

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L47

48 }

49}

scripts/postinstall.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2/**

3 * Best-effort global agent plugin refresh after a global context-cli install.

4 * Local project dependencies and CI installs must not mutate user-level agent

5 * configuration. Link development performs the same refresh in cliLink.ts.

6 */

8import { spawnSync } from "node:child_process";

9import { existsSync, realpathSync }

cli.jsView file

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

cli.jsView on unpkg

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

cli.jsView on unpkg

•path = cli.js kind = oversized_source_file sizeBytes = 4383696 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

cli.jsView on unpkg

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

@c4a/context-cli@0.6.19

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code