@costrict/csc@4.2.20: Suspicious npm security report (Warn)

Loading npm security reports…

@costrict/csc@4.2.20: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

8 flagged

Lines 57-97json

57 "build:binary:all": "bun run build && bun run compile:linux && bun run compile:linux-baseline && bun run compile:linux-musl && bun run compile:linux-musl-baseline && bun run compile:win && bun run compile:win-baseline && bun run compile:mac-arm64 && bun run compile:mac-x64 && bun run compile:mac-x64-baseline",

58 "compile:linux": "bun build dist/cli.js --compile --target=bun-linux-x64 --outfile dist/csc-linux-x64",

59 "compile:linux-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-baseline --outfile dist/csc-linux-x64-baseline",

60 "compile:linux-musl": "bun build dist/cli.js --compile --target=bun-linux-x64-musl --outfile dist/csc-linux-x64-musl",

61 "compile:linux-musl-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-musl-baseline --outfile dist/csc-linux-x64-musl-baseline",

62 "compile:win": "bun build dist/cli.js --compile --target=bun-windows-x64 --outfile dist/csc-windows-x64.exe",

63 "compile:win-baseline": "bun build dist/cli.js --compile --target=bun-windows-x64-baseline --outfile dist/csc-windows-x64-baseline.exe",

64 "compile:mac-arm64": "bun build dist/cli.js --compile --target=bun-darwin-arm64 --outfile dist/csc-darwin-arm64",

65 "compile:mac-x64": "bun build dist/cli.js --compile --target=bun-darwin-x64 --outfile dist/csc-darwin-x64",

66 "compile:mac-x64-baseline": "bun build dist/cli.js --compile --target=bun-darwin-x64-baseline --outfile dist/csc-darwin-x64-baseline",

67 "dev": "bun run scripts/dev.ts",

68 "dev:inspect": "bun run scripts/dev-debug.ts",

69 "prepublishOnly": "bun run security:scan && bun run build",

70 "lint": "biome lint src/",

71 "lint:fix": "biome lint --fix src/",

72 "format": "biome format --write src/",

73 "prepare": "git config core.hooksPath .githooks",

74 "test": "bun test",

75 "check:unused": "knip-bun",

76 "health": "bun run scripts/health-check.ts",

77 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "docs:dev": "npx mintlify dev",

79 "typecheck": "tsc --noEmit",

80 "rcs": "bun run scripts/rcs.ts",

81 "self-verify": "bun run scripts/self-verify.ts",

82 "security:scan": "bun run scripts/security-scan.ts"

83 },

84 "dependencies": {

85 "@agentclientprotocol/sdk": "^0.19.2",

86 "@anthropic-ai/sandbox-runtime": "^0.0.54",

87 "@claude-code-best/mcp-chrome-bridge": "^2.0.9",

88 "@protobufjs/utf8": "1.1.1",

89 "baseline-browser-mapping": "2.10.29",

90 "gray-matter": "^4.0.3",

91 "hono": "^4.12.26",

92 "partial-json": "^0.1.7",

93 "pngjs": "5.0.0",

94 "semver": "^7.8.4",

95 "undici": "^7.28.0",

96 "ws": "^8.21.0"

97 },

scripts/install-cosknow.mjsView file

Lines 1-35javascript

1import { spawnSync, execSync } from 'node:child_process'

2import { join } from 'node:path'

3import { pathToFileURL } from 'node:url'

5// 全局安装最新版

6spawnSync('npm', ['install'

scripts/postinstall.cjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 33978487 magicHex = [redacted]

Medium

Oversized Source File

Package contains source files above the normal full-analysis size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 33978487 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install-cosknow.mjsView file

21try { L22: const mod = await import(pathToFileURL(join(globalPrefix, '@costrict', 'cosknow', 'dist', 'index.js')).href) L23: install = mod.install

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install-cosknow.mjsView on unpkg · L21

scripts/postinstall.cjsView file

15require("fs") L16: const { spawn, spawnSync } = require("child_process") L17: const { setDefaultResultOrder } = require("node:dns") L18: const path = require("path") ... L32: const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}` L33: const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "") L34: // costrict change: fallback to private registry when GitHub and ghproxy are both unreachable L35: const COSTRICT_PRIVATE_BASE = "https://shenma.sangfor.com.cn/costrict-cli/pkg/ripgrep" ... L42: function getPlatformMapping() { L43: const arch = process.arch L44: const platform = process.platform ... L119: // csc.ps1 before csc.cmd, and enterprise ExecutionPolicy often blocks .ps

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/postinstall.cjsView on unpkg · L15

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjs