@c4a/context-cli@0.7.26: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@c4a/context-cli@0.7.26: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.mjsView file

7L8: import { spawnSync } from "node:child_process"; L9: import { existsSync, realpathSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L7

42"Claude plugin installed without a global context CLI. Install it with:", L43: ` npm install -g @c4a/context-cli@${version}`, L44: ], ... L49: const lookup = process.platform === "win32" L50: ? spawnSync("where", ["context"], { stdio: "ignore" }) L51: : spawnSync("sh", ["-c", "command -v context"], { stdio: "ignore" });

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L42

parserEntryWorker.jsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31: var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

parserEntryWorker.jsView on unpkg · L29

cli.jsView file

35class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

cli.jsView on unpkg · L35

•Trigger-reachable chain: manifest.main -> cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.jsView on unpkg

35Cross-file remote execution chain: cli.js spawns browser/diagrams.js; helper contains network access plus dynamic code execution. L35: class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

browser/diagrams.jsView file

•path = browser/diagrams.js kind = oversized_source_file sizeBytes = 4207607 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

browser/diagrams.jsView on unpkg

Source & flagged code

12 flagged

package.jsonView file

Lines 41-64json

41 "handlebars": "^4.7.8",

42 "ink": "^5.0.0",

43 "jiti": "^2.7.0",

44 "mdast-util-to-string": "^4.0.0",

45 "mermaid": "11.12.0",

46 "react": "^18.3.1",

47 "remark-gfm": "^4.0.1",

48 "remark-mdx": "^3.1.1",

49 "remark-parse": "^11.0.0",

50 "remark-stringify": "^11.0.0",

51 "sharp": "^0.35.3",

52 "typescript": "^5.5.4",

53 "unified": "^11.0.5",

54 "vitepress": "1.6.4",

55 "web-tree-sitter": "^0.20.8",

56 "yaml": "^2.5.1",

57 "zod": "^3.23.8"

58 },

59 "main": "./cli.js",

60 "scripts": {

61 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L61

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L61

62 }

63}

64

scripts/postinstall.mjsView file

Lines 1-62javascript

1#!/usr/bin/env node

2/**

3 * Best-effort global agent plugin refresh after a global context-cli install.

4 * Local project dependencies and CI installs must not mutate user-level agent

5 * configuration. Link development performs the same refresh in cliLink.ts.

6 */

7

8import { spawnSync } from "node:child_process";

9import { existsSync, realpathSync }

parserEntryWorker.jsView file

29var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res); L30: var __require = /* @__PURE__ */ createRequire(import.meta.url); L31: var require = __require;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

parserEntryWorker.jsView on unpkg · L29

cli.jsView file

35class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

Critical

Dns Exfiltration

Source appears to send environment or credential material through DNS lookups.

cli.jsView on unpkg · L35

•Trigger-reachable chain: manifest.main -> cli.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

cli.jsView on unpkg

35Cross-file remote execution chain: cli.js spawns browser/diagrams.js; helper contains network access plus dynamic code execution. L35: class CommanderError extends Error { L36: constructor(exitCode, code, message) { L37: super(message); ... L610: var EventEmitter = __require("events").EventEmitter; L611: var childProcess = __require("child_process"); L612: var path = __require("path"); ... L655: this._outputConfiguration = { L656: writeOut: (str) => process2.stdout.write(str), L657: writeErr: (str) => process2.stderr.write(str), ... L2781: return false; L2782: const base64 = header.replace(/-/g, "+").replace(/_/g, "/").padEnd(header.length + (4 - header.length % 4) % 4, "="); L2783: const decoded = JSON.parse(atob(base64));

wasm/tree-sitter.wasmView file

•path = wasm/tree-sitter.wasm kind = wasm_module sizeBytes = 186526 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

wasm/tree-sitter.wasmView on unpkg

browser/diagrams.jsView file

•path = browser/diagrams.js kind = oversized_source_file sizeBytes = 4207607 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

browser/diagrams.jsView on unpkg