@cartanova/qgrid-cli@2.7.4: AI-agent control-surface risk

Loading npm security reports…

Source & flagged code

13 flagged

package.jsonView file

Lines 43-66json

43 "sonamu": "0.10.3",

44 "typescript": "6.0.3",

45 "ws": "8.20.0",

46 "zod": "^4.3.6"

47 },

48 "devDependencies": {

49 "@types/node": "25.0.7",

50 "@types/pg": "^8.20.0",

51 "@types/ws": "8.18.1",

52 "semver": "^7.7.4",

53 "tsdown": "^0.22.3",

54 "yaml": "^2.8.2"

55 },

56 "engines": {

57 "node": ">=20"

58 },

59 "scripts": {

60 "bundle": "pnpm run check:bundle-dependencies && cd ../api && pnpm build && cd ../cli && rm -rf bundle && mkdir -p bundle/public && touch bundle/.env && cp -r ../api/dist ./bundle/dist && cp -r ../api/web-dist ./bundle/web-dist && cp -r ../api/src ./bundle/src",

61 "build": "tsdown",

62 "check:bundle-dependencies": "node tooling/check-bundled-api-dependencies.mjs",

63 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L63

64 "test": "vitest run --dir src && node --test tooling/check-bundled-api-dependencies.node-test.mjs"

65 }

66}

bundle/web-dist/server/assets/services.generated-B5UkNmgc.jsView file

18664try { L18665: new Function(""); L18666: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/services.generated-B5UkNmgc.jsView on unpkg · L18664

dist/cli.jsView file

Lines 275-315javascript

275 applyQgridDatabaseEnv(process.env);

276 process.env.PORT = serverPort;

277 process.env.NODE_ENV ||= "production";

278 if (process.env.NODE_ENV !== "staging"

bundle/web-dist/server/entry-server.generated.jsView file

22if (!shouldRedactErrors(error)) return Promise.reject(error); L23: if (process.env.NODE_ENV !== "production") console.error(`A query that was dehydrated as pending ended up rejecting. [${query.queryHash}]: ${error}; The error will be redacted in p... L24: return Promise.reject(/* @__PURE__ */ new Error("redacted")); ... L32: ...query.state, L33: ...query.state.data !== void 0 && { data: serializeData(query.state.data) } L34: }, ... L401: const promises = notifyManager.batch(() => this.#queryCache.findAll(filters).filter((query) => !query.isDisabled() && !query.isStatic()).map((query) => { L402: let promise = query.fetch(void 0, fetchOptions); L403: if (!fetchOptions.throwOnError) promise = promise.catch(noop$1); ... L1081: const persistedState = safeSessionStorage.getItem(storageKey);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L22

postinstall.mjsView file

Lines 34-74javascript

34}

36function defaultProjectRoot() {

37 if (process.env.QGRID_SKILLS_CWD) return findProjectRoot(process.env.QGRID_SKILLS_CWD);

38 if (process.env.INIT_CWD) return

bundle/dist/application/qgrid/tool-emulation.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundle/dist/application/qgrid/tool-emulation.jsView on unpkg

bundle/dist/utils/providers/anthropic/claude-session.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.7.3 matchedPath = [redacted]-session.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/anthropic/claude-session.jsView on unpkg

bundle/src/utils/providers/anthropic/claude-session.tsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.7.3 matchedPath = [redacted]-session.ts matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/src/utils/providers/anthropic/claude-session.tsView on unpkg

bundle/web-dist/client/assets/services.generated-CA7oRRYY.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.7.3 matchedPath = bundle/web-dist/client/assets/services.generated-CSW8bhCP.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/web-dist/client/assets/services.generated-CA7oRRYY.jsView on unpkg

bundle/web-dist/server/assets/lazyRouteComponent-tS-rTksX.jsView file

•matchType = normalized_sha256 matchedPackage = @cartanova/qgrid-cli@2.7.3 matchedPath = bundle/web-[redacted]-0y-znAfz.js matchedIdentity = npm:QGNhcnRhbm92YS9xZ3JpZC1jbGk:2.7.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/web-dist/server/assets/lazyRouteComponent-tS-rTksX.jsView on unpkg

Source & flagged code

13 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bundle/web-dist/server/assets/services.generated-B5UkNmgc.jsView file

18664try { L18665: new Function(""); L18666: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/services.generated-B5UkNmgc.jsView on unpkg · L18664

@cartanova/qgrid-cli@2.7.4: AI-agent control-surface risk | LPM Firewall

Source & flagged code

13 flagged

package.jsonView file

Lines 43-66json

43 "sonamu": "0.10.3",

44 "typescript": "6.0.3",

45 "ws": "8.20.0",

46 "zod": "^4.3.6"

47 },

48 "devDependencies": {

49 "@types/node": "25.0.7",

50 "@types/pg": "^8.20.0",

51 "@types/ws": "8.18.1",

52 "semver": "^7.7.4",

53 "tsdown": "^0.22.3",

54 "yaml": "^2.8.2"

55 },

56 "engines": {

57 "node": ">=20"

58 },

59 "scripts": {

61 "build": "tsdown",

62 "check:bundle-dependencies": "node tooling/check-bundled-api-dependencies.mjs",

63 "postinstall": "node postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L63

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L63

64 "test": "vitest run --dir src && node --test tooling/check-bundled-api-dependencies.node-test.mjs"

65 }

66}

bundle/web-dist/server/assets/services.generated-B5UkNmgc.jsView file

18664try { L18665: new Function(""); L18666: return true;

Low

Eval

Package source references a known benign dynamic code generation pattern.

bundle/web-dist/server/assets/services.generated-B5UkNmgc.jsView on unpkg · L18664

dist/cli.jsView file

Lines 275-315javascript

275 applyQgridDatabaseEnv(process.env);

276 process.env.PORT = serverPort;

277 process.env.NODE_ENV ||= "production";

278 if (process.env.NODE_ENV !== "staging"

bundle/web-dist/server/entry-server.generated.jsView file

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bundle/web-dist/server/entry-server.generated.jsView on unpkg · L22

postinstall.mjsView file

Lines 34-74javascript

34}

36function defaultProjectRoot() {

37 if (process.env.QGRID_SKILLS_CWD) return findProjectRoot(process.env.QGRID_SKILLS_CWD);

38 if (process.env.INIT_CWD) return

bundle/dist/application/qgrid/tool-emulation.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 5

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bundle/dist/application/qgrid/tool-emulation.jsView on unpkg

bundle/dist/utils/providers/anthropic/claude-session.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/dist/utils/providers/anthropic/claude-session.jsView on unpkg

bundle/src/utils/providers/anthropic/claude-session.tsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/src/utils/providers/anthropic/claude-session.tsView on unpkg

bundle/web-dist/client/assets/services.generated-CA7oRRYY.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/web-dist/client/assets/services.generated-CA7oRRYY.jsView on unpkg

bundle/web-dist/server/assets/lazyRouteComponent-tS-rTksX.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bundle/web-dist/server/assets/lazyRouteComponent-tS-rTksX.jsView on unpkg

@cartanova/qgrid-cli@2.7.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code