@cascade-hq/kit: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@cascade-hq/kit: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

23 flagged · loading source

bin/setup.mjsView file

69patternName = supabase_service_key severity = critical line = 69 matchedText = 'eyJhbGc...JM';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/setup.mjsView on unpkg · L69

69patternName = supabase_service_key severity = critical line = 69 matchedText = 'eyJhbGc...JM';

Critical

Secret Pattern

Supabase service role key (JWT) in bin/setup.mjs

bin/setup.mjsView on unpkg · L69

21import { fileURLToPath } from 'url'; L22: import { execSync } from 'child_process'; L23:

High

Child Process

Package source references child process execution.

bin/setup.mjsView on unpkg · L21

21Cross-file remote execution chain: bin/setup.mjs spawns mcp-server/index.js; helper contains network access plus dynamic code execution. L21: import { fileURLToPath } from 'url'; L22: import { execSync } from 'child_process'; L23: L24: // Polyfill WebSocket for Node < 22 (Supabase requires it) L25: try { ... L51: const __filename = fileURLToPath(import.meta.url); L52: const __dirname = dirname(__filename); L53: const KIT_ROOT = join(__dirname, '..'); ... L92: function prompt(question) { L93: const rl = createInterface({ input: process.stdin, output: process.stdout }); L94: return new Promise(resolve => rl.question(question, answer => { rl.close(); resolve(answer); })); ... L98: return new Promise(resolve => {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/setup.mjsView on unpkg · L21

6* Usage: L7: * npx @cascade-hq/kit setup Full interactive setup (default: core tier) L8: * npx @cascade-hq/kit setup --full Full setup with all 41 MCP tools ... L21: import { fileURLToPath } from 'url'; L22: import { execSync } from 'child_process'; L23:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/setup.mjsView on unpkg · L6

26if (!globalThis.WebSocket) { L27: const ws = await import('ws'); L28: globalThis.WebSocket = ws.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/setup.mjsView on unpkg · L26

mcp-server/index.jsView file

43090patternName = supabase_service_key severity = critical line = 43090 matchedText = var SUPA...JM";

Critical

Secret Pattern

Supabase service role key (JWT) in mcp-server/index.js

mcp-server/index.jsView on unpkg · L43090

48109patternName = google_api_key severity = high line = 48109 matchedText = "https:/...W8",

High

Secret Pattern

Google API key in mcp-server/index.js

mcp-server/index.jsView on unpkg · L48109

13042patternName = generic_password severity = medium line = 13042 matchedText = * pass...rd',

Medium

Secret Pattern

Hardcoded password in mcp-server/index.js

mcp-server/index.jsView on unpkg · L13042

13355patternName = generic_password severity = medium line = 13355 matchedText = * { pa...d' }

Medium

Secret Pattern

Hardcoded password in mcp-server/index.js

mcp-server/index.jsView on unpkg · L13355

data/ingest/youtube_transcript.pyView file

•path = data/ingest/youtube_transcript.py kind = build_helper sizeBytes = 6621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

data/ingest/youtube_transcript.pyView on unpkg

mcp-server/tools/ingest-curator-item.jsView file

341patternName = google_api_key severity = high line = 341 matchedText = "https:/...W8",

High

Secret Pattern

Google API key in mcp-server/tools/ingest-curator-item.js

mcp-server/tools/ingest-curator-item.jsView on unpkg · L341

Source & flagged code

23 flagged

bin/setup.mjsView file

Lines 1-89javascript

1#!/usr/bin/env node

2

3/**

4 * Cascade Kit v0.2.0 - portable installer for Claude Code

5 *

6 * Usage:

7 * npx @cascade-hq/kit setup Full interactive setup (default: core tier)

8 * npx @cascade-hq/kit setup --full Full setup with all 41 MCP tools

9 * npx @cascade-hq/kit login Authenticate with Cascade

10 * npx @cascade-hq/kit status Check installation status

11 * npx @cascade-hq/kit skills Install/update skills only

12 * npx @cascade-hq/kit mcp Configure MCP servers only

13 * npx @cascade-hq/kit uninstall Remove Cascade configuration

14 */

15

16import { readFile, writeFile, mkdir, readdir, copyFile, rm } from 'fs/promises';

17import { existsSync, readFileSync } from 'fs';

18import { join, dirname } from 'path';

19import { homedir } from 'os';

20import { createInterface } from 'readline';

21import { fileURLToPath } from 'url';

22import { execSync } from 'child_process';

23

High

Child Process

Package source references child process execution.

bin/setup.mjsView on unpkg · L21

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/setup.mjsView on unpkg · L6

24// Polyfill WebSocket for Node < 22 (Supabase requires it)

25try {

26 if (!globalThis.WebSocket) {

27 const ws = await import('ws');

28 globalThis.WebSocket = ws.default;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/setup.mjsView on unpkg · L26

29 }

30} catch { /* ws not available, hope native WebSocket exists */ }

31

32// Lazy-load supabase

33let _createClient;

34async function getCreateClient() {

35 if (!_createClient) {

36 try {

37 const mod = await import('@supabase/supabase-js');

38 _createClient = mod.createClient;

39 } catch {

40 const mod = await import(join(KIT_ROOT, 'mcp-server', 'node_modules', '@supabase', 'supabase-js', 'dist', 'module', 'index.js'));

41 _createClient = mod.createClient;

42 }

43 }

44 return _createClient;

45}

46

49// ---------------------------------------------------------------------------

50

51const __filename = fileURLToPath(import.meta.url);

52const __dirname = dirname(__filename);

53const KIT_ROOT = join(__dirname, '..');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

bin/setup.mjsView on unpkg · L21

54

55const CLAUDE_DIR = join(homedir(), '.claude');

56const SETTINGS_PATH = join(CLAUDE_DIR, 'settings.json');

57const CASCADE_DIR = join(homedir(), '.cascade');

58const AUTH_FILE = join(CASCADE_DIR, 'auth.json');

59

60// New v0.2.0 paths

61const COMMANDS_DEST = join(CLAUDE_DIR, 'commands', 'cse');

62const DATA_DEST = join(CLAUDE_DIR, 'cse-data');

63

64// Legacy v0.1.0 paths (for cleanup)

65const LEGACY_SKILLS_DIR = join(CLAUDE_DIR, 'skills');

66

67const SUPABASE_URL = 'https://jocfpjkujuixsnqfhnbh.supabase.co';

68const SUPABASE_ANON_KEY =

69 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImpvY2Zwamt1anVpeHNucWZobmJoIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzE2NTA0MjEsImV4cCI6MjA4NzIyNjQyMX0.Hmc_QwvGJTIu-vbIpfaraziyQhW49v3ic-o2liLRvJM';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

bin/setup.mjsView on unpkg · L69

Critical

Secret Pattern

Supabase service role key (JWT) in bin/setup.mjs

bin/setup.mjsView on unpkg · L69

70

71// ANSI

72const BOLD = '\x1b[1m';

73const DIM = '\x1b[2m';

74const RESET = '\x1b[0m';

75const GREEN = '\x1b[32m';

76const YELLOW = '\x1b[33m';

77const RED = '\x1b[31m';

78const CYAN = '\x1b[36m';

79const CHECK = `${GREEN}OK${RESET}`;

80const WARN = `${YELLOW}!!${RESET}`;

81const FAIL = `${RED}XX${RESET}`;

82

83// CLI flags

84const args = process.argv.slice(2);

85const command = args.find(a => !a.startsWith('-')) || 'setup';

86const isFullTier = args.includes('--full');

87

88// ---------------------------------------------------------------------------

89// Helpers

mcp-server/index.jsView file

43090patternName = supabase_service_key severity = critical line = 43090 matchedText = var SUPA...JM";

Critical

Secret Pattern

Supabase service role key (JWT) in mcp-server/index.js

mcp-server/index.jsView on unpkg · L43090

48109patternName = google_api_key severity = high line = 48109 matchedText = "https:/...W8",

High

Secret Pattern

Google API key in mcp-server/index.js

mcp-server/index.jsView on unpkg · L48109

13042patternName = generic_password severity = medium line = 13042 matchedText = * pass...rd',

Medium

Secret Pattern

Hardcoded password in mcp-server/index.js

mcp-server/index.jsView on unpkg · L13042

13355patternName = generic_password severity = medium line = 13355 matchedText = * { pa...d' }

Medium

Secret Pattern

Hardcoded password in mcp-server/index.js

mcp-server/index.jsView on unpkg · L13355

data/ingest/youtube_transcript.pyView file

•path = data/ingest/youtube_transcript.py kind = build_helper sizeBytes = 6621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

data/ingest/youtube_transcript.pyView on unpkg

mcp-server/tools/ingest-curator-item.jsView file

Lines 321-361javascript

321class TranscriptError extends Error {

322 reason;

323 constructor(reason, message) {

324 super(message);

325