@conceptcraft/mindframes@0.3.24: Suspicious npm security report | LPM Firewall

Loading npm security reports…

@conceptcraft/mindframes@0.3.24: Suspicious npm security report | LPM Firewall

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

7L8: import { execSync } from "child_process"; L9: import { fileURLToPath } from "url";

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L7

•matchType = normalized_sha256 matchedPackage = @conceptcraft/mindframes@0.3.20 matchedPath = bin/postinstall.js matchedIdentity = npm:[redacted]:0.3.20 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/postinstall.jsView on unpkg

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @conceptcraft/mindframes@0.3.2 matchedIdentity = npm:[redacted]:0.3.2 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

2import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: var g={id:"mindframes",name:"mindframes",displayName:"Mindframes",description:"CLI tool for Mindframes presentation generation",commands:["mf","mindframes"],apiUrl:"https://www.min... L4: `):/Every scene is excluded from the video\./.test(t.message)?`Include a scene again with: ${t.binary} presentation video edit ${e} --edit '{"type":"patch_scene","scene":1,"exclude...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

2import { createRequire } from 'module'; const require = createRequire(import.meta.url); L3: var g={id:"mindframes",name:"mindframes",displayName:"Mindframes",description:"CLI tool for Mindframes presentation generation",commands:["mf","mindframes"],apiUrl:"https://www.min... L4: `):/Every scene is excluded from the video\./.test(t.message)?`Include a scene again with: ${t.binary} presentation video edit ${e} --edit '{"type":"patch_scene","scene":1,"exclude...

High

Source & flagged code

8 flagged

package.jsonView file

Lines 7-47json

7 "mf": "./bin/cli.js",

8 "mindframes": "./bin/cli.js"

9 },

10 "files": [

11 "bin",

12 "dist",

13 "LICENSE",

14 "README.md"

15 ],

16 "scripts": {

17 "build": "tsup",

18 "dev": "tsup --watch",

19 "cli:staging": "pnpm build && CONCEPTCRAFT_API_URL=https://cc-slides.productcabin.co node bin/cli.js",

20 "cli:local": "pnpm build && CONCEPTCRAFT_API_URL=http://localhost:3000 node bin/cli.js",

21 "cli:smoke": "bash scripts/live-smoke.sh",

22 "lint": "biome lint --write --unsafe",

23 "format": "biome format --write",

24 "typecheck": "tsc --noEmit",

25 "verify:package": "node scripts/verify-package.mjs",

26 "prepublishOnly": "npm run build && npm run verify:package",

27 "postinstall": "node ./bin/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L27

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L27

28 "test": "vitest run",

29 "test:watch": "vitest",

30 "test:coverage": "vitest run --coverage",

31 "test:e2e": "vitest run --config vitest.e2e.config.ts",

32 "test:integration": "vitest run --config vitest.integration.config.ts",

33 "test:all": "vitest run && vitest run --config vitest.e2e.config.ts"

34 },

35 "keywords": [

36 "conceptcraft",

37 "slides",

38 "presentation",

39 "ai",

40 "cli",

41 "powerpoint",

42 "deck",

43 "generator"

44 ],

45 "author": "ConceptCraft AI",

46 "license": "SEE LICENSE IN LICENSE",

47 "homepage": "https://conceptcraft.ai",

bin/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2

3/**

4 * Post-install script

5 * Installs the main skill and recommended external skills

6 */

7

8import { execSync } from "child_process";

9import { fileURLToPath } from "url"

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire } from 'module'; const require = createRequire(import.meta.url);

3var g={id:"mindframes",name:"mindframes"