Loading npm security reports…

@codyswann/lisa@4.55.25: Malicious npm security report (Block) | LPM Firewall

registry / @codyswann/lisa / 4.55.25

@codyswann/lisa@4.55.25

Claude Code governance framework that applies guardrails, guidance, and automated enforcement to projects

AI Security Review

scanned 26d ago · by lpm-firewall-ai

Installing the package automatically modifies the consumer project and its Claude Code plugin state. It also persists a Lisa command in the consumer's postinstall and can launch a detached reconciliation process.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

npm-compatible installation of the package outside CI.

Impact

A dependency install can alter consumer package scripts, project agent configuration, and future install behavior without an explicit user command.

Mechanism

Lifecycle-driven consumer-project mutation, agent plugin installation, and detached re-execution.

Attack narrative

The package's postinstall targets the parent project, applies its templates, installs project-scoped Claude plugins, and can add a Lisa invocation to the consumer's own postinstall. When package-manager writes would undo those changes, it schedules a detached child to apply them again after installation. This creates unconsented persistence and broad AI-agent control-surface mutation in a consuming project.

AI rationale

This is concrete automatic install-hook abuse: it modifies a foreign consumer's package lifecycle and agent tooling, then retries changes after the installer exits. The absence of observed secret theft does not neutralize the persistent control-surface mutation.

Evidence

package.jsonscripts/install-claude-plugins.shdist/migrations/ensure-lisa-postinstall.jsdist/utils/postinstall-trampoline.jsdist/core/lisa.jsconsumer package.jsonconsumer .claude/settings.json

Source & flagged code

29 flagged

package.jsonView file

Lines 1-29json

2 "scripts": {

3 "build": "bun run build:dist && bun run build:plugins",

4 "build:dist": "node scripts/clean-dist.mjs && tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",

5 "build:dist:in-place": "tsc && node scripts/copy-codex-scripts.mjs && node scripts/copy-opencode-plugin-templates.mjs",

6 "lisa-test-run": "bun run build && node dist/cli/lisa-test-run.js --profile lisa",

7 "test:integration": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration",

8 "test:integration:push": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run tests/integration --exclude='**/mutation-gate-bite.test.ts' --exclude='**/mutation-gate-diff-bite.test.ts' --exclude='**/mutation-sigterm-control.test.ts' --exclude='**/mutation-performance-fixture.test.ts' --exclude='**/mutation-performance-packed-apply.test.ts'",

9 "postinstall": "bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; [ ! -f tsconfig.json ] || tsc -p tsconfig.json || true",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L9

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L9

10 "pretest": "bun run build",

11 "test": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run",

12 "test:unit": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --exclude='**/integration/**' --exclude='**/*.integration.*'",

13 "test:cov": "$npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage",

14 "test:cov:unit": "LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*'",

15 "test:cov:unit:push": "LISA_COVERAGE_SCOPE=unit $npm_execpath run lisa-test-run -- --adapter vitest -- vitest run --coverage --exclude='**/integration/**' --exclude='**/*.integration.*' --exclude='**/measure-tmpdir-growth-performance.test.ts'",

16 "pretest:mutation": "bun run build",

17 "test:mutation": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs",

18 "test:mutation:full": "LISA_TEST_SCRATCH_PREFIXES='[\"lisa-mutation-\",\"worker-\"]' $npm_execpath run lisa-test-run -- --adapter direct -- node scripts/lisa-mutation.mjs --all",

19 "lint": "oxlint --disable-nested-config && eslint . --quiet",

20 "lint:fix": "oxlint --fix --disable-nested-config && eslint . --fix",

21 "lint:slow": "eslint . --config eslint.slow.config.ts --quiet",

22 "typecheck": "tsc --noEmit && bun run typecheck:tests && bun run typecheck:engine-floor",

23 "typecheck:tests": "node scripts/check-typecheck-tests.mjs",

24 "typecheck:engine-floor": "node scripts/check-engine-floor.mjs",

25 "measure:scripts-profile-gap": "bun scripts/measure-scripts-profile-gap.mts",

26 "format:check": "prettier --check .",

27 "format": "prettier --check . --write",

28 "knip:check": "knip",

29 "knip:fix": "knip --fix",

harper-fabric/create-only/.github/workflows/deploy.ymlView file

Lines 85-125yaml

85 test -n "${CLI_TARGET_PASSWORD}" || { echo "Missing CLI_TARGET_PASSWORD secret"; exit 1; }

87 - name: Deploy component to Harper Fabric

88 run: |

89 if command -v harper >/dev/null 2>&1; then

90 HARPER_BIN="harper"

91 elif [ -x node_modules/.bin/harper ]; then

92 HARPER_BIN="node_modules/.bin/harper"

dist/migrations/untrack-codex-marketplace.jsView file

Lines 1-37javascript

1import * as path from "node:path";

2import * as fse from "fs-extra";

3/** Generated Codex marketplace, relative to a project root (posix, git-style). */

4const

dist/core/git-service.jsView file

Lines 1-24javascript

1import { exec } from "node:child_process";

2import { promisify } from "node:util";

3import * as path from "node:path";

4import

harper-fabric/copy-overwrite/eslint.config.tsView file

Lines 12-52typescript

12 * merged into the ignore list so host customizations survive the

13 * copy-overwrite of eslint.ignore.config.json on each Lisa update.

14 *

15 * @see https://eslint.org/docs/latest/use/configure/configuration-files-new

16 *

scripts/check-ui-demo-data.mjsView file

Lines 69-103javascript

69 };

70 `;

71 // The bounded catalog source is intentionally executed in a context with

72 // string/wasm code generation disabled and a hard timeout. This is the

73 // guard's shared-seam contract, not application input.

74 // eslint-disable-next-line sonarjs/code-eval -- Evaluate only the extracted catalog inside the locked VM above.

75 vm.runInContext(program, context, {

76 displayErrors: true,

77 filename: options.filename || "ui/index.html#catalog",

plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs#virtual:normalized:round1View file

2/** L3: * Write the provider"s current view to the two files a materializing surface\n * reads.\n *\n * Only surfaces that cannot read through live use this. A remote agent\n * container p... L4: * run matched the same unowned marker and stripped the first tenant"s block.\n * @param {string} text File contents.\n * @param {string} family Frozen family identifier.\n * @param... ... L98: * variables, and sourced LAST so they win over anything the host injected — L99: * environment variables outrank profile files in AWS"s credential chain, which\n * is the whole reason a valid credential was being ignored.\n *\n * Guarded on the file existing, s... L100: * either. ... L106: const { L107: home = process.env.HOME || homedir(), L108: owner,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs#virtual:normalized:round1View on unpkg · L2

dist/cli/remote-env-cmd.js#virtual:normalized:round1View file

16* L17: * npx -y `@codyswann/lisa@latest` remote-env --phase=secrets L18: * ... L23: */ L24: import { spawnSync } from "node:child_process"; L25: import { existsSync } from "node:fs";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/remote-env-cmd.js#virtual:normalized:round1View on unpkg · L16

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 5104 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 13103 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

all/copy-overwrite/scripts/check-conflict-markers.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 100

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

all/copy-overwrite/scripts/check-conflict-markers.mjs#virtual:normalized:round1View on unpkg

dist/cli/doctor-coderabbit.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/doctor-coderabbit.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/doctor-coderabbit.jsView on unpkg

dist/cli/setup-project.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/setup-project.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup-project.jsView on unpkg

dist/cli/ui-automations-adapters.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/ui-automations-adapters.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-automations-adapters.jsView on unpkg

dist/cli/ui-observability-checks.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/ui-observability-checks.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-observability-checks.jsView on unpkg

dist/cli/update-cmd.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/update-cmd.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/update-cmd.jsView on unpkg

dist/core/kane-cli-process.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/core/kane-cli-process.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/kane-cli-process.jsView on unpkg

dist/core/kane-cli.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/core/kane-cli.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/kane-cli.jsView on unpkg

dist/standards/git-state.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/standards/git-state.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/standards/git-state.jsView on unpkg

dist/utils/postinstall-trampoline.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/utils/postinstall-trampoline.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/postinstall-trampoline.jsView on unpkg

dist/cli/lisa-test-run-runtime.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/lisa-test-run-runtime.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/lisa-test-run-runtime.jsView on unpkg

dist/cli/ui-deploy-pipeline.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/cli/ui-deploy-pipeline.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-deploy-pipeline.jsView on unpkg

dist/core/learnings-merge-driver-install.jsView file

•matchType = normalized_sha256 matchedPackage = @codyswann/lisa@4.55.24 matchedPath = dist/core/learnings-merge-driver-install.js matchedIdentity = npm:QGNvZHlzd2Fubi9saXNh:4.55.24 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/learnings-merge-driver-install.jsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14

Source & flagged code

29 flagged · loading source

package.jsonView file

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; [ ! -f tsconfig.json ] || tsc -p tsconfig.json || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = bash ./scripts/install-claude-plugins.sh || true; node ./scripts/install-generated-artifact-merge-driver.mjs || true; [ ! -f tsconfig.json ] || tsc -p tsconfig.json || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

harper-fabric/create-only/.github/workflows/deploy.ymlView file

105patternName = generic_password severity = medium line = 105

Medium

Secret Pattern

Package contains a possible secret pattern.

harper-fabric/create-only/.github/workflows/deploy.ymlView on unpkg · L105

dist/migrations/untrack-codex-marketplace.jsView file

17* L18: * `child_process` is dynamically imported (matching `src/core/lisa.ts`) so the L19: * static security lint for command paths is not tripped; every command passed

High

Child Process

Package source references child process execution.

dist/migrations/untrack-codex-marketplace.jsView on unpkg · L17

dist/core/git-service.jsView file

4import * as fse from "fs-extra"; L5: const execAsync = promisify(exec); L6: /**

High

Shell

Package source references shell execution.

dist/core/git-service.jsView on unpkg · L4

harper-fabric/copy-overwrite/eslint.config.tsView file

32L33: const require = createRequire(import.meta.url); L34: const __filename = fileURLToPath(import.meta.url);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

harper-fabric/copy-overwrite/eslint.config.tsView on unpkg · L32

scripts/check-ui-demo-data.mjsView file

89}); L90: process.stdout.write( L91: `[ui-demo-data] PASS: inspected ${inspection.audit.inspected} rendered values across ${inspection.audit.sections} sections\n`

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

scripts/check-ui-demo-data.mjsView on unpkg · L89

plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs#virtual:normalized:round1View file

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

plugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs#virtual:normalized:round1View on unpkg · L2

dist/cli/remote-env-cmd.js#virtual:normalized:round1View file

16* L17: * npx -y `@codyswann/lisa@latest` remote-env --phase=secrets L18: * ... L23: */ L24: import { spawnSync } from "node:child_process"; L25: import { existsSync } from "node:fs";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/remote-env-cmd.js#virtual:normalized:round1View on unpkg · L16

harper-fabric/create-only/scripts/zap-baseline.shView file

•path = harper-fabric/create-only/scripts/zap-baseline.sh kind = build_helper sizeBytes = 5104 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

harper-fabric/create-only/scripts/zap-baseline.shView on unpkg

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView file

•path = plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py kind = payload_in_excluded_dir sizeBytes = 13103 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

plugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.pyView on unpkg

all/copy-overwrite/scripts/check-conflict-markers.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 100

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

all/copy-overwrite/scripts/check-conflict-markers.mjs#virtual:normalized:round1View on unpkg

dist/cli/doctor-coderabbit.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/doctor-coderabbit.jsView on unpkg

dist/cli/setup-project.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/setup-project.jsView on unpkg

dist/cli/ui-automations-adapters.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-automations-adapters.jsView on unpkg

dist/cli/ui-observability-checks.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-observability-checks.jsView on unpkg

dist/cli/update-cmd.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/update-cmd.jsView on unpkg

dist/core/kane-cli-process.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/kane-cli-process.jsView on unpkg

dist/core/kane-cli.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/kane-cli.jsView on unpkg

dist/standards/git-state.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/standards/git-state.jsView on unpkg

dist/utils/postinstall-trampoline.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/utils/postinstall-trampoline.jsView on unpkg

dist/cli/lisa-test-run-runtime.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/lisa-test-run-runtime.jsView on unpkg

dist/cli/ui-deploy-pipeline.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/cli/ui-deploy-pipeline.jsView on unpkg

dist/core/learnings-merge-driver-install.jsView file

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/core/learnings-merge-driver-install.jsView on unpkg

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

plugins/lisa-wiki-copilot/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki/scripts/wiki-safety.mjs

plugins/lisa-wiki/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-agy/scripts/wiki-safety.mjs

plugins/lisa-wiki-agy/scripts/wiki-safety.mjsView on unpkg · L14

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

plugins/lisa-wiki-cursor/scripts/wiki-safety.mjsView on unpkg · L14

plugins/src/wiki/scripts/wiki-safety.mjsView file

14patternName = generic_password severity = medium line = 14

Medium

Secret Pattern

Hardcoded password in plugins/src/wiki/scripts/wiki-safety.mjs

plugins/src/wiki/scripts/wiki-safety.mjsView on unpkg · L14

Findings

18 High14 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/migrations/untrack-codex-marketplace.js

HighShelldist/core/git-service.js

HighRuntime Package Installdist/cli/remote-env-cmd.js#virtual:normalized:round1

HighPayload In Excluded Dirplugins/lisa-expo/.codex-plugin/skills/container-view-pattern/scripts/validate_component.py

HighSemantic Analysis Limitedall/copy-overwrite/scripts/check-conflict-markers.mjs#virtual:normalized:round1

HighKnown Malware Source Similaritydist/cli/doctor-coderabbit.js

HighKnown Malware Source Similaritydist/cli/setup-project.js

HighKnown Malware Source Similaritydist/cli/ui-automations-adapters.js

HighKnown Malware Source Similaritydist/cli/ui-observability-checks.js

HighKnown Malware Source Similaritydist/cli/update-cmd.js

HighKnown Malware Source Similaritydist/core/kane-cli-process.js

HighKnown Malware Source Similaritydist/core/kane-cli.js

HighKnown Malware Source Similaritydist/standards/git-state.js

HighKnown Malware Source Similaritydist/utils/postinstall-trampoline.js

HighKnown Malware Source Similaritydist/cli/lisa-test-run-runtime.js

HighKnown Malware Source Similaritydist/cli/ui-deploy-pipeline.js

HighKnown Malware Source Similaritydist/core/learnings-merge-driver-install.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumSecret Patternharper-fabric/create-only/.github/workflows/deploy.yml

MediumDynamic Requireharper-fabric/copy-overwrite/eslint.config.ts

MediumUnsafe Vm Contextscripts/check-ui-demo-data.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceplugins/lisa-cursor/skills/lisa-secrets-access/scripts/materialize-secrets.mjs#virtual:normalized:round1

MediumShips Build Helperharper-fabric/create-only/scripts/zap-baseline.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternplugins/lisa-wiki-copilot/scripts/wiki-safety.mjs

MediumSecret Patternplugins/lisa-wiki/scripts/wiki-safety.mjs

MediumSecret Patternplugins/lisa-wiki-agy/scripts/wiki-safety.mjs

MediumSecret Patternplugins/lisa-wiki-cursor/scripts/wiki-safety.mjs

MediumSecret Patternplugins/src/wiki/scripts/wiki-safety.mjs

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings