@cartanova/qgrid-cli@2.10.0: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@cartanova/qgrid-cli@2.10.0: Suspicious npm security report | LPM Firewall

Source & flagged code

14 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bundle/web-dist/server/assets/services.generated-BsKOUSXl.jsView file

18664try { L18665: new Function(""); L18666: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/services.generated-BsKOUSXl.jsView on unpkg · L18664

dist/cli.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.9.2 matchedPath = dist/cli.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.9.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli.jsView on unpkg

294try { L295: const client = new (await (import("pg"))).default.Client({ L296: host: dbHost,

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L294

bundle/web-dist/server/entry-server.generated.jsView file

22if (!shouldRedactErrors(error)) return Promise.reject(error); L23: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L24: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L32: ...query.state, L33: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L34: }, ... L401: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L402: let promise = query.fetch(void 0, fetchOptions); L403: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1081: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L22

postinstall.mjsView file

54if (hasArg("--global") || isGlobalInstall) { L55: const codexHome = process.env.CODEX_HOME L56: ? path.resolve(process.env.CODEX_HOME) L57: : path.join(os.homedir(), ".codex"); L58: const claudeHome = process.env.CLAUDE_HOME L59: ? path.resolve(process.env.CLAUDE_HOME) L60: : path.join(os.homedir(), ".claude"); L61: return [ ... L77: label: "Codex", L78: target: path.join(projectRoot, ".agents", "skills", "qgrid"), L79: useSymlink: true, ... L82: label: "Claude Code",

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L54

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: name(fileurltopath(import.meta.url)); const sourceskillsdir = path.join(packagedir, "skills", "qgrid"); function hasarg(name) { return process.argv.slice(2).includes(name); } function findprojectroot(startdir) { let current = path.resolve(startdir); let packagejsonroot = null; while (true) { if ( existssync(path.join(current, "pnpm-workspace.yaml")) || existssync(path.join(current, ".git")) ) { return current; } if (!packagejsonroot && existssync(path.join(current, "package.json"))) { packagejsonroot = current; } const parent = path.dirname(current); if (parent === current) return packagejsonroot ?? path.resolve(startdir); current =

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

postinstall.mjsView on unpkg

bundle/dist/application/qgrid/tool-emulation.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundle/dist/application/qgrid/tool-emulation.jsView on unpkg

bundle/dist/node_modules/.pnpm/@vitest_utils@4.1.10/node_modules/@vitest/utils/dist/source-map.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.9.2 matchedPath = bundle/dist/node_modules/.pnpm/@vitest_utils@4.1.10/node_modules/@vitest/utils/dist/source-map.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.9.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/node_modules/.pnpm/@vitest_utils@4.1.10/node_modules/@vitest/utils/dist/source-map.jsView on unpkg

bundle/dist/utils/providers/anthropic/claude-session.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.9.2 matchedPath = [redacted]-session.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.9.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/anthropic/claude-session.jsView on unpkg

bundle/src/utils/providers/anthropic/claude-session.tsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.9.2 matchedPath = [redacted]-session.ts matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.9.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/src/utils/providers/anthropic/claude-session.tsView on unpkg

bundle/dist/node_modules/.pnpm/magic-string@0.30.21/node_modules/magic-string/dist/magic-string.es.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.9.2 matchedPath = bundle/dist/node_modules/.pnpm/magic-string@0.30.21/node_modules/magic-string/dist/magic-string.es.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.9.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/node_modules/.pnpm/magic-string@0.30.21/node_modules/magic-string/dist/magic-string.es.jsView on unpkg

bundle/dist/node_modules/.pnpm/vitest@4.1.10_@opentelemetry_api@1.9.0_@types_node@25.0.7_@vitest_coverage-v8@4.1.10_vi_a1977b93af7bb69308bcb1dbab39b618/node_modules/vitest/dist/chunks/test.DNmyFkvJ.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.9.2 matchedPath = bundle/dist/node_modules/.pnpm/vitest@4.1.10_@opentelemetry_api@1.9.0_@types_node@25.0.7_@vitest_coverage-v8@4.1.10_vi_a1977b93af7bb69308bcb1dbab39b618/node_modules/vitest/dist/chunks/test.DNmyFkvJ.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.9.2 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/node_modules/.pnpm/vitest@4.1.10_@opentelemetry_api@1.9.0_@types_node@25.0.7_@vitest_coverage-v8@4.1.10_vi_a1977b93af7bb69308bcb1dbab39b618/node_modules/vitest/dist/chunks/test.DNmyFkvJ.jsView on unpkg