@conceptcraft/mindframes: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@conceptcraft/mindframes: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

7L8: import { execSync } from "node:child_process"; L9: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @conceptcraft/mindframes@0.3.21 matchedPath = bin/postinstall.js matchedIdentity = npm:[redacted]:0.3.21 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

dist/index.jsView file

2import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: var h={id:"mindframes",name:"mindframes",displayName:"Mindframes",description:"CLI tool for Mindframes presentation generation",commands:["mf","mindframes"],apiUrl:"https://www.min... L4: `);let t=iy.createInterface({input:process.stdin,terminal:process.stdin.isTTY===!0});try{return(await new Promise(i=>{if(process.stdin.isTTY){t.question(`Approve this exact request... L5: Then paste the approval receipt: `,i);return}let o=!1,c=l=>{o||(o=!0,i(l))};t.on("line",c),t.on("close",()=>c(""))})).trim()||void 0}finally{t.close()}}import{spawnSync as oy}from"... L6: `):null}var pn="terminalRunFailure",de=class extends Error{[pn]=!0};function un(e){return!!e&&typeof e=="object"&&e[pn]===!0}function oe(e,t

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

2import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: var h={id:"mindframes",name:"mindframes",displayName:"Mindframes",description:"CLI tool for Mindframes presentation generation",commands:["mf","mindframes"],apiUrl:"https://www.min... L4: `);let t=iy.createInterface({input:process.stdin,terminal:process.stdin.isTTY===!0});try{return(await new Promise(i=>{if(process.stdin.isTTY){t.question(`Approve this exact request... L5: Then paste the approval receipt: `,i);return}let o=!1,c=l=>{o||(o=!0,i(l))};t.on("line",c),t.on("close",()=>c(""))})).trim()||void 0}finally{t.close()}}import{spawnSync as oy}from"... L6: `):null}var pn="terminalRunFailure",de=class extends Error{[pn]=!0};function un(e){return!!e&&typeof e=="object"&&e[pn]===!0}function oe(e,t

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L2

Source & flagged code

7 flagged

package.jsonView file

Lines 7-47json

7 "mf": "./bin/cli.js",

8 "mindframes": "./bin/cli.js"

9 },

10 "files": [

11 "bin",

12 "dist",

13 "LICENSE",

14 "README.md"

15 ],

16 "scripts": {

17 "build": "tsup",

18 "dev": "tsup --watch",

19 "cli:staging": "pnpm build && CONCEPTCRAFT_API_URL=https://cc-slides.productcabin.co node bin/cli.js",

20 "cli:local": "pnpm build && CONCEPTCRAFT_API_URL=http://localhost:3000 node bin/cli.js",

21 "cli:smoke": "bash scripts/live-smoke.sh",

22 "lint": "biome lint --write --unsafe",

23 "format": "biome format --write",

24 "typecheck": "tsc --noEmit",

25 "verify:package": "node scripts/verify-package.mjs",

26 "prepublishOnly": "npm run build && npm run verify:package",

27 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "vitest run",

29 "test:watch": "vitest",

30 "test:coverage": "vitest run --coverage",

31 "test:e2e": "vitest run --config vitest.e2e.config.ts",

32 "test:integration": "vitest run --config vitest.integration.config.ts",

33 "test:all": "vitest run && vitest run --config vitest.e2e.config.ts"

34 },

35 "keywords": [

36 "conceptcraft",

37 "slides",

38 "presentation",

39 "ai",

40 "cli",

41 "powerpoint",

42 "deck",

43 "generator"

44 ],

45 "author": "ConceptCraft AI",

46 "license": "SEE LICENSE IN LICENSE",

47 "homepage": "https://conceptcraft.ai",

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/**

4 * Post-install script

5 * Installs the main skill and recommended external skills

6 */

7

8import { execSync } from "node:child_process";

9import { fileURLToPath } from "node:url"

dist/index.jsView file

2import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: var h={id:"mindframes",name:"mindframes",displayName:"Mindframes",description:"CLI tool for Mindframes presentation generation",commands:["mf","mindframes"],apiUrl:"https://www.min... L4: `);let t=iy.createInterface({input:process.stdin,terminal:process.stdin.isTTY===!0});try{return(await new Promise(i=>{if(process.stdin.isTTY){t.question(`Approve this exact request... L5: Then paste the approval receipt: `,i);return}let o=!1,c=l=>{o||(o=!0,i(l))};t.on("line",c),t.on("close",()=>c(""))})).trim()||void 0}finally{t.close()}}import{spawnSync as oy}from"... L6: `):null}var pn="terminalRunFailure",de=class extends Error{[pn]=!0};function un(e){return!!e&&typeof e=="object"&&e[pn]===!0}function oe(e,t

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

2import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: var h={id:"mindframes",name:"mindframes",displayName:"Mindframes",description:"CLI tool for Mindframes presentation generation",commands:["mf","mindframes"],apiUrl:"https://www.min... L4: `);let t=iy.createInterface({input:process.stdin,terminal:process.stdin.isTTY===!0});try{return(await new Promise(i=>{if(process.stdin.isTTY){t.question(`Approve this exact request... L5: Then paste the approval receipt: `,i);return}let o=!1,c=l=>{o||(o=!0,i(l))};t.on("line",c),t.on("close",()=>c(""))})).trim()||void 0}finally{t.close()}}import{spawnSync as oy}from"... L6: `):null}var pn="terminalRunFailure",de=class extends Error{[pn]=!0};function un(e){return!!e&&typeof e=="object"&&e[pn]===!0}function oe(e,t

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L2