@costrict/csc@4.2.8: Suspicious npm security report (Warn)

Loading npm security reports…

@costrict/csc@4.2.8: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

9 flagged

Lines 57-97json

57 "build:binary:all": "bun run build && bun run compile:linux && bun run compile:linux-baseline && bun run compile:linux-musl && bun run compile:linux-musl-baseline && bun run compile:win && bun run compile:win-baseline && bun run compile:mac-arm64 && bun run compile:mac-x64 && bun run compile:mac-x64-baseline",

58 "compile:linux": "bun build dist/cli.js --compile --target=bun-linux-x64 --outfile dist/csc-linux-x64",

59 "compile:linux-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-baseline --outfile dist/csc-linux-x64-baseline",

60 "compile:linux-musl": "bun build dist/cli.js --compile --target=bun-linux-x64-musl --outfile dist/csc-linux-x64-musl",

61 "compile:linux-musl-baseline": "bun build dist/cli.js --compile --target=bun-linux-x64-musl-baseline --outfile dist/csc-linux-x64-musl-baseline",

62 "compile:win": "bun build dist/cli.js --compile --target=bun-windows-x64 --outfile dist/csc-windows-x64.exe",

63 "compile:win-baseline": "bun build dist/cli.js --compile --target=bun-windows-x64-baseline --outfile dist/csc-windows-x64-baseline.exe",

64 "compile:mac-arm64": "bun build dist/cli.js --compile --target=bun-darwin-arm64 --outfile dist/csc-darwin-arm64",

65 "compile:mac-x64": "bun build dist/cli.js --compile --target=bun-darwin-x64 --outfile dist/csc-darwin-x64",

66 "compile:mac-x64-baseline": "bun build dist/cli.js --compile --target=bun-darwin-x64-baseline --outfile dist/csc-darwin-x64-baseline",

67 "dev": "bun run scripts/dev.ts",

68 "dev:inspect": "bun run scripts/dev-debug.ts",

69 "prepublishOnly": "bun run security:scan && bun run build",

70 "lint": "biome lint src/",

71 "lint:fix": "biome lint --fix src/",

72 "format": "biome format --write src/",

73 "prepare": "git config core.hooksPath .githooks",

74 "test": "bun test",

75 "check:unused": "knip-bun",

76 "health": "bun run scripts/health-check.ts",

77 "postinstall": "node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L77

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L77

78 "docs:dev": "npx mintlify dev",

79 "typecheck": "tsc --noEmit",

80 "rcs": "bun run scripts/rcs.ts",

81 "self-verify": "bun run scripts/self-verify.ts",

82 "security:scan": "bun run scripts/security-scan.ts"

83 },

84 "dependencies": {

85 "@agentclientprotocol/sdk": "^0.19.2",

86 "@anthropic-ai/sandbox-runtime": "^0.0.54",

87 "@claude-code-best/mcp-chrome-bridge": "^2.0.9",

88 "@protobufjs/utf8": "1.1.1",

89 "baseline-browser-mapping": "2.10.29",

90 "gray-matter": "^4.0.3",

91 "hono": "^4.12.26",

92 "partial-json": "^0.1.7",

93 "pngjs": "5.0.0",

94 "semver": "^7.8.4",

95 "undici": "^7.28.0",

96 "ws": "^8.21.0"

97 },

scripts/install-cosknow.mjsView file

Lines 1-35javascript

1import { spawnSync, execSync } from 'node:child_process'

2import { join } from 'node:path'

3import { pathToFileURL } from 'node:url'

4

5// 全局安装最新版

6spawnSync('npm', ['install'

dist/services/rawDump/batchWorker.jsView file

Lines 1-37javascript

1// @bun

2var __require = typeof import.meta.require === "function" ? import.meta.require : (await import(

scripts/postinstall.cjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Postinstall script — runs automatically after `bun install` or `npm install`.

4 *

5 * Downloads ripgrep binary (idempotent, skips if exists).

6 * Works in dev mode (src/ exists), published mode (dist/ exists), with bun or node.

7 *

8 * Usage:

9 * node scripts/postinstall.js

10 * node scripts/postinstall.js --force

11 * bun run scripts/postinstall.js

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView file

•path = dist/vendor/audio-capture/x64-darwin/audio-capture.node kind = native_binary sizeBytes = 439076 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

dist/vendor/audio-capture/x64-darwin/audio-capture.nodeView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 34538658 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 34538658 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-parallel.mjs scripts/postinstall.cjs scripts/setup-chrome-mcp.mjs scripts/install-cosknow.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/install-cosknow.mjsView file

21try { L22: const mod = await import(pathToFileURL(join(globalPrefix, '@costrict', 'cosknow', 'dist', 'index.js')).href) L23: install = mod.install

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/install-cosknow.mjsView on unpkg · L21

dist/services/rawDump/batchWorker.jsView file

17const candidates = [ L18: process.env.COSTRICT_CONFIG_DIR || "", L19: path.join(os.homedir(), ".costrict"), L20: process.env.CLAUDE_CONFIG_DIR || "", ... L288: const text = await fs2.readFile(CONVERSATION_FILE, "utf-8"); L289: const parsed = JSON.parse(text); L290: state_conv = { ... L476: const platform = os2.platform(); L477: const hostname = os2.hostname(); L478: const username = os2.userInfo().username; ... L515: const require2 = createRequire(import.meta.url); L516: const pkg = require2("../../../package.json");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/services/rawDump/batchWorker.jsView on unpkg · L17

17const candidates = [ L18: process.env.COSTRICT_CONFIG_DIR || "", L19: path.join(os.homedir(), ".costrict"), L20: process.env.CLAUDE_CONFIG_DIR || "", ... L288: const text = await fs2.readFile(CONVERSATION_FILE, "utf-8"); L289: const parsed = JSON.parse(text); L290: state_conv = { ... L476: const platform = os2.platform(); L477: const hostname = os2.hostname(); L478: const username = os2.userInfo().username; ... L515: const require2 = createRequire(import.meta.url); L516: const pkg = require2("../../../package.json");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/services/rawDump/batchWorker.jsView on unpkg · L17

scripts/postinstall.cjsView file

15require("fs") L16: const { spawn, spawnSync } = require("child_process") L17: const { setDefaultResultOrder } = require("node:dns") L18: const path = require("path") ... L32: const MIRROR_RELEASE_BASE = `https://ghproxy.net/https://github.com/microsoft/ripgrep-prebuilt/releases/download/v${RG_VERSION}` L33: const RELEASE_BASE = (process.env.RIPGREP_DOWNLOAD_BASE ?? DEFAULT_RELEASE_BASE).replace(/\/$/, "") L34: // costrict change: fallback to private registry when GitHub and ghproxy are both unreachable L35: const COSTRICT_PRIVATE_BASE = "https://shenma.sangfor.com.cn/costrict-cli/pkg/ripgrep" ... L42: function getPlatformMapping() { L43: const arch = process.arch L44: const platform = process.platform ... L119: // csc.ps1 before csc.cmd, and enterprise ExecutionPolicy often blocks .ps

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/postinstall.cjsView on unpkg · L15