@circuitwall/jarela@1.41.3: Suspicious npm security report (Warn)

Loading npm security reports…

@circuitwall/jarela@1.41.3: Suspicious npm security report (Warn) | LPM Firewall

AI called this Suspicious at 84.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

The local-file route accepts absolute paths and returns readable file content without an authorization check in this handler.
The update route accepts POST requests and starts a global npm installation of this package, then exits the server after success.
The package can create a per-user autostart service, but its CLI reaches that action only through an explicit command or interactive prompt.
Configured integration probes send supplied credentials to the corresponding service endpoints, including a package OAuth proxy for Gmail.

Evidence against

The install lifecycle runs a hint script that exits unless the installation is global and only writes terminal output.
No self-dependency on @circuitwall/jarela appears in package.json.
The flagged browserslist and jest-worker evaluation code is bundled third-party module-loading behavior, not package-authored remote-response execution.
The inspected large chunk and @keyv serializer contain ordinary dependency code; no hidden payload was established.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 925 file(s), 5.52 MB of source, external domains: 127.0.0.1, 169.254.169.254, a.atlassian.net, a.io, accounts.google.com, acme.atlassian.net, acme.jiraalign.com, ai.google.dev, aistudio.google.com, anthropic.com, anthropic.proxy.internal, api-docs.deepseek.com, api.anthropic.com, api.cohere.com, api.deepseek.com, api.example.com, api.github.com, api.githubcopilot.com, api.linkedin.com, api.openai.com, api.tavily.com, attacker.example, b.io, blog.example, caldav.icloud.com, cdn.example.com, cnn.com, cohere.com, console.anthropic.com, console.cloud.google.com, docs.example.org, docs.github.com, docs.langchain.com, duckduckgo.com, entra.microsoft.com, env.anthropic.example, evil.com, example.atlassian.net, example.com, example.org, example.test, foo.example.com, gemini.google, generativelanguage.googleapis.com, github.com, gmail.googleapis.com, graph.microsoft.com, hostname.tail.ts, html.duckduckgo.com, id.atlassian.com

Source & flagged code

16 flagged

package.jsonView file

Lines 76-116json

76 "scripts/check-npm-package.mjs",

77 "scripts/install-to-system.sh",

78 "scripts/install-to-system.ps1",

79 "scripts/installed-launcher.ps1",

80 "scripts/installed-launcher.vbs",

81 "scripts/install-tailscale-serve.ps1",

82 "scripts/uninstall-tailscale-serve.ps1",

83 "scripts/uninstall-from-system.ps1",

84 "scripts/release-docker.mjs",

85 "next.config.ts",

86 "tsconfig.json",

87 "postcss.config.mjs",

88 "CHANGELOG.md",

89 "docs/INSTALL.md"

90 ],

91 "scripts": {

92 "setup:hooks": "node scripts/setup-git-hooks.mjs",

93 "packages:build": "node scripts/run-workspace-script-if-present.mjs build",

94 "packages:test": "node scripts/run-workspace-script-if-present.mjs test",

95 "prepare": "npm run packages:build --silent 1>&2",

96 "postinstall": "node scripts/postinstall-hint.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L96

97 "dev": "next dev --webpack -p 4312",

98 "build": "npm run packages:build && next build --webpack && node scripts/postbuild.mjs",

99 "build:extension": "node scripts/build-extension.mjs",

100 "start": "node scripts/start-prod.mjs",

101 "lint": "eslint . && node scripts/check-integration-manifests.mjs && node scripts/check-dockerfile-workspaces.mjs",

102 "security:audit": "npm audit --omit=dev --audit-level=high",

103 "security:secrets": "node scripts/scan-secrets.mjs --all",

104 "security:terms": "node scripts/scan-sensitive-terms.mjs --all",

105 "security:link-preview": "node scripts/check-link-preview-version.mjs",

106 "security:routes": "node scripts/check-route-bundles.mjs",

107 "security:ci": "npm run security:audit && npm run security:secrets && npm run security:terms && npm run security:link-preview",

108 "check:conventions": "node scripts/check-git-conventions.mjs --branch",

109 "check:impact": "node scripts/check-change-impact.mjs",

110 "pricing:snapshot": "node scripts/snapshot-pricing.mjs",

111 "prompts:dump": "node scripts/dump-prompts.mjs",

112 "prepublishOnly": "node scripts/rewrite-workspace-deps.mjs",

113 "test:package": "node scripts/check-npm-package.mjs",

114 "test": "vitest run",

115 "test:watch": "vitest",

116 "test:eval": "vitest run lib/agents/output-validator/eval.test.ts",

app/api/v1/update/apply/route.tsView file

Lines 1-39typescript

1// Self-update endpoint.

2//

3// POST /api/v1/update/apply

4// Kicks off `npm i -g @circuitwall/jarela@latest` (or `#main` if the

5// user opted into the experimental channel) in a detached child, then

6// returns 202 immediately. The child's stdout/stderr is streamed into

7// an in-memory ring so the UI can show progress.

8//

9// When the install succeeds the route schedules `process.exit(0)` so

10// the supervisor (Task Scheduler / systemd / launchd / installed

app/api/v1/local-file/route.tsView file

Lines 117-143typescript

117 body = await req.json();

118 } catch {

119 return NextResponse.json({ error: "invalid json" }, { status: 400 });

120 }

121 if

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView file

Lines 1-1javascript

1(()=>{var __webpack_modules__={368:e=>{function BrowserslistError(e){this.name="BrowserslistError";this.message=e;

browser-extension/agent-overlay.jsView file

Lines 37-77javascript

37 // The host is positioned via fixed coordinates so it floats above

38 // every page chrome. The contents live in a closed shadow root so

39 // page rules can't restyle us.

40 hostEl.style.cssText = [

41 "all: initial",

42 "position: fixed",

43 "inset: 0"

lib/embeddings/index.tsView file

Lines 31-71typescript

31 function fromConfig(cfg: ModelConfigRow | null): {

32 provider: ReturnType<typeof getProvider>;

33 modelId

scripts/service-install.mjsView file

Lines 1-38javascript

1// service-install.mjs — register/unregister Jarela as a per-user autostart

2// service on Windows, macOS, or Linux. Invoked by `jarela install-service`

3// and `jarela uninstall-service` from scripts/jarela-bin.mjs.

4//

5// All operations are user-scoped — no admin / sudo required:

6// - Windows : Scheduled Task "Jarela" (AtLogOn, current user) → wscript

7// + VBS shim → node jarela-bin.mjs start (hidden window)

8// - macOS : ~/Library/LaunchAgents/com.jarela.app.plist (RunAtLoad +

9// KeepAlive) → node jarela-bin.mjs start

scripts/update.mjsView file

Lines 1-33javascript

1// CLI-side update helpers.

2//

3// - notifyIfBehind(): prints a banner to stderr if the running version is

4// behind the latest on the configured channel. Best-effort, non-blocking-ish.

5// - runUpdate(): re-invokes `npm i -g <pkg>@latest` (stable channel) or pulls

6// from `main` (experimental channel). Detects "running from a cloned source

7// tree" and either does a `git pull`+rebuild or bails with instructions.

8//

9// Channels:

10// JARELA_UPDATE_CHANNEL=stable (default) tracks the npm "latest" tag

lib/health/probes.tsView file

12import { resolvePackageAuth } from "@/lib/tools/runtime/auth-registry"; L13: import { spawnSync } from "node:child_process"; L14: ... L25: import { registerDefaultPackages } from "@/lib/tools/packages/default-packages"; L26: if (process.env.NEXT_PHASE !== "phase-production-build") { L27: registerDefaultPackages(); ... L107: try { L108: const res = await fetch(`${auth.url}/rest/api/3/myself`, { L109: headers: { L110: Authorization: "Basic " + Buffer.from(`${auth.email}:${auth.apiToken}`).toString("base64"), L111: Accept: "application/json", ... L207: try {

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/health/probes.tsView on unpkg · L12

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={994:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View file

•path = .next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6 kind = native_binary sizeBytes = 18621496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View on unpkg

scripts/installed-launcher.ps1View file

•path = scripts/installed-launcher.ps1 kind = build_helper sizeBytes = 9904 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/installed-launcher.ps1View on unpkg

.next/standalone/.next/server/chunks/5210.jsView file

•path = .next/standalone/.next/server/chunks/5210.js kind = payload_in_excluded_dir sizeBytes = 6080560 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/5210.jsView on unpkg

•path = .next/standalone/.next/server/chunks/5210.js kind = oversized_source_file sizeBytes = 6080560 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

.next/standalone/.next/server/chunks/5210.jsView on unpkg

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 83

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView on unpkg

Source & flagged code

16 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-hint.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

app/api/v1/update/apply/route.tsView file

19import { join } from "node:path"; L20: import { spawn } from "node:child_process"; L21: import { NextResponse } from "next/server";

High

Child Process

Package source references child process execution.

app/api/v1/update/apply/route.tsView on unpkg · L19

app/api/v1/local-file/route.tsView file

137const child = process.platform === "win32" L138: ? spawn("powershell.exe", ["-NoProfile", "-Command", "Start-Process -LiteralPath $args[0]", abs], { detached: true, stdio: "ignore", windowsHide: true }) L139: : process.platform === "darwin"

High

Shell

Package source references shell execution.

app/api/v1/local-file/route.tsView on unpkg · L137

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView file

1(()=>{var __webpack_modules__={368:e=>{function BrowserslistError(e){this.name="BrowserslistError";this.message=e;this.browserslist=true;if(Error.captureStackTrace){Error.captureSt...

High

Eval

Package source references dynamic code evaluation.

.next/standalone/node_modules/next/dist/compiled/browserslist/index.jsView on unpkg · L1

browser-extension/agent-overlay.jsView file

57let applyBrand = null; L58: const brandReady = import(chrome.runtime.getURL("lib/brand.mjs")) L59: .then((m) => {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

browser-extension/agent-overlay.jsView on unpkg · L57

lib/embeddings/index.tsView file

51L52: const explicitName = process.env.EMBEDDING_MODEL_CONFIG; L53: // 1) explicit embedding model name (if provided). ... L93: function embeddingCacheKey(modelId: string, text: string): string { L94: return `${modelId}\u0000${createHash("sha1").update(text).digest("base64")}`; L95: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

lib/embeddings/index.tsView on unpkg · L51

scripts/service-install.mjsView file

18Trigger-reachable persistence chain: manifest.bin -> scripts/jarela-bin.mjs -> scripts/service-install.mjs L18: L19: import { spawnSync, execFileSync } from "node:child_process"; L20: import { existsSync, mkdirSync, writeFileSync, unlinkSync, rmSync, chmodSync } from "node:fs"; ... L45: for (const k of PROXY_ENV_KEYS) { L46: const v = process.env[k]; L47: if (v && v.length > 0) out[k] = v; ... L59: if (env && env.length > 0) { L60: return env.startsWith("~") ? env.replace(/^~/, homedir()) : env; L61: } ... L93: if (!existsSync(kc)) continue; L94: let stdout; L95: try {

High

Trigger Reachable Persistence

A manifest entrypoint or package-local install chain reaches persistence behavior.

scripts/service-install.mjsView on unpkg · L18

18L19: import { spawnSync, execFileSync } from "node:child_process"; L20: import { existsSync, mkdirSync, writeFileSync, unlinkSync, rmSync, chmodSync } from "node:fs"; ... L45: for (const k of PROXY_ENV_KEYS) { L46: const v = process.env[k]; L47: if (v && v.length > 0) out[k] = v; ... L59: if (env && env.length > 0) { L60: return env.startsWith("~") ? env.replace(/^~/, homedir()) : env; L61: } ... L93: if (!existsSync(kc)) continue; L94: let stdout; L95: try {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/service-install.mjsView on unpkg · L18

scripts/update.mjsView file

13import { existsSync, readFileSync } from "node:fs"; L14: import { spawnSync } from "node:child_process"; L15: import { join } from "node:path"; ... L18: const REPO = "CircuitWall/jarela"; L19: const REGISTRY_URL = `https://registry.npmjs.org/${PACKAGE_NAME}/latest`; L20: const GH_COMMIT_URL = `https://api.github.com/repos/${REPO}/commits/main`; ... L24: function resolveChannel() { L25: return (process.env.JARELA_UPDATE_CHANNEL ?? "").trim().toLowerCase() === "main" ? "main" : "stable"; L26: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/update.mjsView on unpkg · L13

lib/health/probes.tsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

lib/health/probes.tsView on unpkg · L12

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView file

1(()=>{"use strict";var __webpack_modules__={994:(e,r)=>{Object.defineProperty(r,"__esModule",{value:true});r.PARENT_MESSAGE_SETUP_ERROR=r.PARENT_MESSAGE_OK=r.PARENT_MESSAGE_CUSTOM=...

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

.next/standalone/node_modules/next/dist/compiled/jest-worker/threadChild.jsView on unpkg · L1

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View file

•path = .next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6 kind = native_binary sizeBytes = 18621496 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

.next/standalone/node_modules/@img/sharp-libvips-linux-x64/lib/libvips-cpp.so.8.18.6View on unpkg

scripts/installed-launcher.ps1View file

•path = scripts/installed-launcher.ps1 kind = build_helper sizeBytes = 9904 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/installed-launcher.ps1View on unpkg

.next/standalone/.next/server/chunks/5210.jsView file

•path = .next/standalone/.next/server/chunks/5210.js kind = payload_in_excluded_dir sizeBytes = 6080560 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/5210.jsView on unpkg

•path = .next/standalone/.next/server/chunks/5210.js kind = oversized_source_file sizeBytes = 6080560 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

.next/standalone/.next/server/chunks/5210.jsView on unpkg

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView file

•stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 83

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

.next/standalone/node_modules/@keyv/serialize/dist/index.jsView on unpkg