@cliangdev/conductor: Suspicious npm security report (Warn)

Loading npm security reports…

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 40 file(s), 214 KB of source, external domains: conductor-backend-199707291514.us-central1.run.app, conductor-frontend-199707291514.us-central1.run.app, my-backend.example.com

Source & flagged code

3 flagged

package.jsonView file

Lines 10-49json

10 "engines": {

11 "node": ">=22.14.0",

12 "npm": ">=11.5.1"

13 },

14 "packageManager": "npm@11.17.0",

15 "type": "module",

16 "bin": {

17 "conductor": "./dist/index.js"

18 },

19 "main": "./dist/index.js",

20 "files": [

21 "dist/",

22 "assets/",

23 "scripts/"

24 ],

25 "scripts": {

26 "build": "tsc",

27 "typecheck:fast": "tsgo --noEmit",

28 "dev": "ts-node src/index.ts",

29 "test": "vitest run",

30 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L30

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L30

31 "preuninstall": "node scripts/preuninstall.js"

32 },

33 "dependencies": {

34 "@modelcontextprotocol/sdk": "^1.0.0",

35 "chalk": "^5.3.0",

36 "chokidar": "^5.0.0",

37 "commander": "^15.0.0",

38 "open": "^11.0.0",

39 "ora": "^9.4.0"

40 },

41 "devDependencies": {

42 "@types/node": "^26.0.0",

43 "@typescript/native-preview": "^7.0.0-dev",

44 "ts-node": "^10.9.0",

45 "typescript": "^6.0.3",

46 "vitest": "^4.1.5"

47 }

48}

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { createRequire } from 'module';

3import { Command } from 'commander';

4const require = createRequire(import.meta.url);

Source & flagged code

3 flagged · loading source

package.jsonView file

@cliangdev/conductor: Suspicious npm security report (Warn) | LPM Firewall

@cliangdev/conductor@0.10.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Behavioral surface

Source & flagged code