@cartanova/qgrid-cli@2.4.8: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@cartanova/qgrid-cli@2.4.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bundle/web-dist/server/assets/sd.generated-qzuRe35X.jsView file

18478try { L18479: new Function(""); L18480: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/sd.generated-qzuRe35X.jsView on unpkg · L18478

dist/cli.jsView file

216try { L217: const client = new (await (import("pg"))).default.Client({ L218: host: dbHost,

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L216

bundle/web-dist/server/entry-server.generated.jsView file

18if (!shouldRedactErrors(error)) return Promise.reject(error); L19: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L20: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L28: ...query.state, L29: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L30: }, ... L397: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L398: let promise = query.fetch(void 0, fetchOptions); L399: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1077: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L18

postinstall.mjsView file

54if (hasArg("--global") || isGlobalInstall) { L55: const codexHome = process.env.CODEX_HOME L56: ? path.resolve(process.env.CODEX_HOME) L57: : path.join(os.homedir(), ".codex"); L58: const claudeHome = process.env.CLAUDE_HOME L59: ? path.resolve(process.env.CLAUDE_HOME) L60: : path.join(os.homedir(), ".claude"); L61: return [ ... L77: label: "Codex", L78: target: path.join(projectRoot, ".agents", "skills", "qgrid"), L79: useSymlink: true, ... L82: label: "Claude Code",

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

postinstall.mjsView on unpkg · L54

bundle/dist/utils/providers/openai/codex-worker.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cartanova/qgrid-cli@2.4.4 matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.4.4 similarity = 0.755 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bundle/dist/utils/providers/openai/codex-worker.jsView on unpkg